Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 16:47

General

  • Target

    2317f826534fde1723fecdc925185f8e_JaffaCakes118.exe

  • Size

    438KB

  • MD5

    2317f826534fde1723fecdc925185f8e

  • SHA1

    9eb2d5f2005b15db9b357c13ad3b8d14b0bfe400

  • SHA256

    810c5c9481ac4aeb7cb339188894964a79b652ad603d34a55e81598d62ad8e45

  • SHA512

    ab3770052ec3328664148aa1c3ddb2ae637b89b7b9f987a158dd4d6190d4d8c2801e5e1d329419400fbed28a63e14e473f9a36d69b09ddca80795708543649af

  • SSDEEP

    6144:cRRJnML+pdyFnKZ9fF/d5RsggXeNHmyLSpoLVDijud98gWNlPTGQQm6agrds:cLpA+pMFnKJ/5rgXMbSgGjukNtTirds

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Windows directory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2317f826534fde1723fecdc925185f8e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2317f826534fde1723fecdc925185f8e_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\uninstal.bat
      2⤵
      • Deletes itself
      PID:1140
  • C:\Windows\Hacker.com.cn.exe
    C:\Windows\Hacker.com.cn.exe
    1⤵
    • Executes dropped EXE
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
        PID:2936

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Hacker.com.cn.exe

      Filesize

      438KB

      MD5

      2317f826534fde1723fecdc925185f8e

      SHA1

      9eb2d5f2005b15db9b357c13ad3b8d14b0bfe400

      SHA256

      810c5c9481ac4aeb7cb339188894964a79b652ad603d34a55e81598d62ad8e45

      SHA512

      ab3770052ec3328664148aa1c3ddb2ae637b89b7b9f987a158dd4d6190d4d8c2801e5e1d329419400fbed28a63e14e473f9a36d69b09ddca80795708543649af

    • C:\Windows\uninstal.bat

      Filesize

      218B

      MD5

      f85552b6c595282d26e3e22fb636ef17

      SHA1

      db51dd2834f93c2ee184a6a46d9d477153a72f3d

      SHA256

      2780d6f373656f3c3ba801964da89f480e726436e642942b311c44a641040eef

      SHA512

      5b459f9bef98b6740806021c9373cb2a54eb8c835a08ccfa826dded3b3f14d9623e527bea3c03e1d17453c03c9a48ab5212de304ae27d5dc0ad5a78c7818afd1

    • memory/1956-0-0x0000000000400000-0x00000000004E8000-memory.dmp

      Filesize

      928KB

    • memory/1956-1-0x0000000000340000-0x0000000000383000-memory.dmp

      Filesize

      268KB

    • memory/1956-2-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/1956-27-0x0000000002040000-0x0000000002041000-memory.dmp

      Filesize

      4KB

    • memory/1956-46-0x00000000025F0000-0x00000000025F1000-memory.dmp

      Filesize

      4KB

    • memory/1956-45-0x0000000002610000-0x0000000002611000-memory.dmp

      Filesize

      4KB

    • memory/1956-44-0x00000000025E0000-0x00000000025E1000-memory.dmp

      Filesize

      4KB

    • memory/1956-43-0x00000000025C0000-0x00000000025C1000-memory.dmp

      Filesize

      4KB

    • memory/1956-42-0x00000000025A0000-0x00000000025A1000-memory.dmp

      Filesize

      4KB

    • memory/1956-41-0x0000000002540000-0x0000000002541000-memory.dmp

      Filesize

      4KB

    • memory/1956-40-0x0000000002030000-0x0000000002031000-memory.dmp

      Filesize

      4KB

    • memory/1956-39-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

      Filesize

      4KB

    • memory/1956-38-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

      Filesize

      4KB

    • memory/1956-37-0x0000000001F30000-0x0000000001F31000-memory.dmp

      Filesize

      4KB

    • memory/1956-36-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

      Filesize

      4KB

    • memory/1956-35-0x0000000002600000-0x0000000002601000-memory.dmp

      Filesize

      4KB

    • memory/1956-34-0x00000000025D0000-0x00000000025D1000-memory.dmp

      Filesize

      4KB

    • memory/1956-33-0x00000000025B0000-0x00000000025B1000-memory.dmp

      Filesize

      4KB

    • memory/1956-32-0x0000000002590000-0x0000000002591000-memory.dmp

      Filesize

      4KB

    • memory/1956-31-0x0000000002570000-0x0000000002571000-memory.dmp

      Filesize

      4KB

    • memory/1956-30-0x0000000002580000-0x0000000002581000-memory.dmp

      Filesize

      4KB

    • memory/1956-29-0x0000000002550000-0x0000000002551000-memory.dmp

      Filesize

      4KB

    • memory/1956-28-0x0000000002560000-0x0000000002561000-memory.dmp

      Filesize

      4KB

    • memory/1956-26-0x0000000002020000-0x0000000002021000-memory.dmp

      Filesize

      4KB

    • memory/1956-25-0x0000000002000000-0x0000000002001000-memory.dmp

      Filesize

      4KB

    • memory/1956-24-0x0000000002010000-0x0000000002011000-memory.dmp

      Filesize

      4KB

    • memory/1956-23-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

      Filesize

      4KB

    • memory/1956-22-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

      Filesize

      4KB

    • memory/1956-21-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

      Filesize

      4KB

    • memory/1956-20-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

      Filesize

      4KB

    • memory/1956-19-0x0000000001F80000-0x0000000001F81000-memory.dmp

      Filesize

      4KB

    • memory/1956-18-0x0000000001F90000-0x0000000001F91000-memory.dmp

      Filesize

      4KB

    • memory/1956-17-0x0000000001F20000-0x0000000001F21000-memory.dmp

      Filesize

      4KB

    • memory/1956-16-0x0000000001F00000-0x0000000001F01000-memory.dmp

      Filesize

      4KB

    • memory/1956-15-0x0000000001F10000-0x0000000001F11000-memory.dmp

      Filesize

      4KB

    • memory/1956-14-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

      Filesize

      4KB

    • memory/1956-13-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

      Filesize

      4KB

    • memory/1956-12-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

      Filesize

      4KB

    • memory/1956-11-0x0000000000560000-0x0000000000561000-memory.dmp

      Filesize

      4KB

    • memory/1956-10-0x0000000000520000-0x0000000000521000-memory.dmp

      Filesize

      4KB

    • memory/1956-9-0x0000000000510000-0x0000000000511000-memory.dmp

      Filesize

      4KB

    • memory/1956-8-0x0000000000550000-0x0000000000551000-memory.dmp

      Filesize

      4KB

    • memory/1956-7-0x0000000000530000-0x0000000000531000-memory.dmp

      Filesize

      4KB

    • memory/1956-6-0x0000000000540000-0x0000000000543000-memory.dmp

      Filesize

      12KB

    • memory/1956-5-0x0000000000500000-0x0000000000501000-memory.dmp

      Filesize

      4KB

    • memory/1956-4-0x00000000002E0000-0x00000000002E1000-memory.dmp

      Filesize

      4KB

    • memory/1956-3-0x00000000002F0000-0x00000000002F1000-memory.dmp

      Filesize

      4KB

    • memory/1956-49-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1956-54-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/1956-53-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/1956-52-0x0000000003390000-0x0000000003391000-memory.dmp

      Filesize

      4KB

    • memory/1956-51-0x0000000002620000-0x0000000002621000-memory.dmp

      Filesize

      4KB

    • memory/1956-50-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1956-48-0x0000000002640000-0x0000000002641000-memory.dmp

      Filesize

      4KB

    • memory/1956-47-0x0000000002630000-0x0000000002631000-memory.dmp

      Filesize

      4KB

    • memory/1956-57-0x0000000003550000-0x0000000003551000-memory.dmp

      Filesize

      4KB

    • memory/1956-58-0x0000000003540000-0x0000000003541000-memory.dmp

      Filesize

      4KB

    • memory/1956-56-0x0000000003520000-0x0000000003521000-memory.dmp

      Filesize

      4KB

    • memory/1956-55-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1956-61-0x0000000003570000-0x0000000003571000-memory.dmp

      Filesize

      4KB

    • memory/1956-73-0x0000000003630000-0x0000000003631000-memory.dmp

      Filesize

      4KB

    • memory/1956-84-0x00000000036C0000-0x00000000036C1000-memory.dmp

      Filesize

      4KB

    • memory/1956-83-0x00000000036D0000-0x00000000036D1000-memory.dmp

      Filesize

      4KB

    • memory/1956-82-0x00000000036A0000-0x00000000036A1000-memory.dmp

      Filesize

      4KB

    • memory/1956-81-0x00000000036B0000-0x00000000036B1000-memory.dmp

      Filesize

      4KB

    • memory/1956-80-0x0000000003680000-0x0000000003681000-memory.dmp

      Filesize

      4KB

    • memory/1956-79-0x0000000003690000-0x0000000003691000-memory.dmp

      Filesize

      4KB

    • memory/1956-78-0x0000000003660000-0x0000000003661000-memory.dmp

      Filesize

      4KB

    • memory/1956-77-0x0000000003670000-0x0000000003671000-memory.dmp

      Filesize

      4KB

    • memory/1956-76-0x0000000003640000-0x0000000003641000-memory.dmp

      Filesize

      4KB

    • memory/1956-75-0x0000000003650000-0x0000000003651000-memory.dmp

      Filesize

      4KB

    • memory/1956-74-0x0000000003620000-0x0000000003621000-memory.dmp

      Filesize

      4KB

    • memory/1956-72-0x0000000003600000-0x0000000003601000-memory.dmp

      Filesize

      4KB

    • memory/1956-71-0x0000000003610000-0x0000000003611000-memory.dmp

      Filesize

      4KB

    • memory/1956-70-0x00000000035E0000-0x00000000035E1000-memory.dmp

      Filesize

      4KB

    • memory/1956-69-0x00000000035F0000-0x00000000035F1000-memory.dmp

      Filesize

      4KB

    • memory/1956-68-0x00000000035C0000-0x00000000035C1000-memory.dmp

      Filesize

      4KB

    • memory/1956-67-0x00000000035D0000-0x00000000035D1000-memory.dmp

      Filesize

      4KB

    • memory/1956-66-0x00000000035A0000-0x00000000035A1000-memory.dmp

      Filesize

      4KB

    • memory/1956-65-0x00000000035B0000-0x00000000035B1000-memory.dmp

      Filesize

      4KB

    • memory/1956-64-0x0000000003580000-0x0000000003581000-memory.dmp

      Filesize

      4KB

    • memory/1956-63-0x0000000003590000-0x0000000003591000-memory.dmp

      Filesize

      4KB

    • memory/1956-62-0x0000000003560000-0x0000000003561000-memory.dmp

      Filesize

      4KB

    • memory/1956-86-0x00000000036E0000-0x00000000036E1000-memory.dmp

      Filesize

      4KB

    • memory/1956-85-0x00000000036F0000-0x00000000036F1000-memory.dmp

      Filesize

      4KB

    • memory/1956-88-0x0000000000400000-0x00000000004E8000-memory.dmp

      Filesize

      928KB

    • memory/1956-90-0x0000000000340000-0x0000000000383000-memory.dmp

      Filesize

      268KB

    • memory/1956-102-0x0000000000340000-0x0000000000383000-memory.dmp

      Filesize

      268KB

    • memory/1956-101-0x0000000000400000-0x00000000004E8000-memory.dmp

      Filesize

      928KB

    • memory/2548-89-0x0000000000400000-0x00000000004E8000-memory.dmp

      Filesize

      928KB

    • memory/2548-91-0x0000000000300000-0x0000000000343000-memory.dmp

      Filesize

      268KB

    • memory/2548-104-0x0000000000400000-0x00000000004E8000-memory.dmp

      Filesize

      928KB

    • memory/2548-106-0x0000000000300000-0x0000000000343000-memory.dmp

      Filesize

      268KB