Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 09:09

General

  • Target

    21cf2423cc48b1dd2496bc34b435a932_JaffaCakes118.exe

  • Size

    797KB

  • MD5

    21cf2423cc48b1dd2496bc34b435a932

  • SHA1

    639257ece6992db28a2962a8bde071507ebfce55

  • SHA256

    ff3b095fdcb45b12a60ba1c914578da6233a047e1111d53c7640db20e9e208c7

  • SHA512

    0cb636f041c82bff1b6925f740a2086fd885de12751d15a6bd98daa7d088be46cc5fc6fec650bbf36fd36eeee58acdc0360be405c6158f5137a2a328cd05f0e0

  • SSDEEP

    12288:Hj/kT1PyjoPiAYIvXGtU8VqDPvlZSfpjy/LuYD3Njb0ZM9+LNDiz6vrEFERxv951:D89b7CCuUCjcA6cLvW

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21cf2423cc48b1dd2496bc34b435a932_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\21cf2423cc48b1dd2496bc34b435a932_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\ProgramData\bduirchl.exe
      "C:\ProgramData\bduirchl.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe

    Filesize

    31KB

    MD5

    ed797d8dc2c92401985d162e42ffa450

    SHA1

    0f02fc517c7facc4baefde4fe9467fb6488ebabe

    SHA256

    b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

    SHA512

    e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

  • \ProgramData\bduirchl.exe

    Filesize

    797KB

    MD5

    21cf2423cc48b1dd2496bc34b435a932

    SHA1

    639257ece6992db28a2962a8bde071507ebfce55

    SHA256

    ff3b095fdcb45b12a60ba1c914578da6233a047e1111d53c7640db20e9e208c7

    SHA512

    0cb636f041c82bff1b6925f740a2086fd885de12751d15a6bd98daa7d088be46cc5fc6fec650bbf36fd36eeee58acdc0360be405c6158f5137a2a328cd05f0e0

  • memory/1280-0-0x00000000749E1000-0x00000000749E2000-memory.dmp

    Filesize

    4KB

  • memory/1280-1-0x00000000749E0000-0x0000000074F8B000-memory.dmp

    Filesize

    5.7MB

  • memory/1280-2-0x00000000749E0000-0x0000000074F8B000-memory.dmp

    Filesize

    5.7MB

  • memory/1280-14-0x00000000749E0000-0x0000000074F8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2708-15-0x00000000749E0000-0x0000000074F8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2708-18-0x00000000749E0000-0x0000000074F8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2708-19-0x00000000749E0000-0x0000000074F8B000-memory.dmp

    Filesize

    5.7MB