Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 03:37

General

  • Target

    247f1eb3aacfd74490b3f959d18aad12_JaffaCakes118.exe

  • Size

    57KB

  • MD5

    247f1eb3aacfd74490b3f959d18aad12

  • SHA1

    9e7df71ad2896ed9623e73052fba3e7dffeeaffa

  • SHA256

    fd35616b0750a1d51cfb01aacd7bc67574d8fbcd0d6a295199d244ff825a5c60

  • SHA512

    c31d6afc274321cbc6b05c3d34010ab278b0e16902be05aa012e5bb09e8cb8ef137614f0d1fbb0a49421048137a1e736c0d91a7d34f6fd485cdfba99ed63a365

  • SSDEEP

    1536:QLU7mzmRNbSmCpGcZLCguutoZFpcmOlOPMWkf0CqI+/02bPn:GGFRNWmpcERuO2rOPZknqIA0g/

Malware Config

Signatures

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\247f1eb3aacfd74490b3f959d18aad12_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\247f1eb3aacfd74490b3f959d18aad12_JaffaCakes118.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • outlook_win_path
    PID:2228

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2228-2-0x0000000013140000-0x000000001317D000-memory.dmp

    Filesize

    244KB

  • memory/2228-1-0x0000000000230000-0x0000000000237000-memory.dmp

    Filesize

    28KB

  • memory/2228-0-0x0000000000220000-0x000000000022D000-memory.dmp

    Filesize

    52KB

  • memory/2228-3-0x0000000013140000-0x0000000013181000-memory.dmp

    Filesize

    260KB

  • memory/2228-4-0x0000000013140000-0x0000000013181000-memory.dmp

    Filesize

    260KB

  • memory/2228-6-0x0000000013140000-0x000000001317D000-memory.dmp

    Filesize

    244KB