Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    05/07/2024, 00:03

General

  • Target

    26bb785e94a8548d48b43d5ec1680fce_JaffaCakes118.exe

  • Size

    321KB

  • MD5

    26bb785e94a8548d48b43d5ec1680fce

  • SHA1

    777cb5199771a2ea09aeedd91a63e7251d806459

  • SHA256

    e87875ca2cd4b2005e47c636fc5f684ff404b38b414af3c773351e926e9825ce

  • SHA512

    e860803e2cc981fac4723f3eaaa76c4718ac3563a0bb5f4d6ea6d916a12be4fd54703b493698f17cfe453ae7dddfbbccc97b4d208ec7d0c9951ddc1b98ff6282

  • SSDEEP

    6144:jvAmr15QpNezQDG/kFKz60cBJO13qnGObdv/RsScyBFKtjuE:jvtxqNGQDG/kF3BJG2GO9/RvEBz

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26bb785e94a8548d48b43d5ec1680fce_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\26bb785e94a8548d48b43d5ec1680fce_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2556
    • C:\ProgramData\nMQsPVYoUn.exe
      C:\ProgramData\nMQsPVYoUn.exe
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      PID:2976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\nMQsPVYoUn.exe

    Filesize

    321KB

    MD5

    26bb785e94a8548d48b43d5ec1680fce

    SHA1

    777cb5199771a2ea09aeedd91a63e7251d806459

    SHA256

    e87875ca2cd4b2005e47c636fc5f684ff404b38b414af3c773351e926e9825ce

    SHA512

    e860803e2cc981fac4723f3eaaa76c4718ac3563a0bb5f4d6ea6d916a12be4fd54703b493698f17cfe453ae7dddfbbccc97b4d208ec7d0c9951ddc1b98ff6282

  • memory/2556-0-0x0000000000470000-0x00000000004B9000-memory.dmp

    Filesize

    292KB

  • memory/2556-1-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB

  • memory/2556-2-0x0000000000451000-0x0000000000464000-memory.dmp

    Filesize

    76KB

  • memory/2556-3-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB

  • memory/2556-6-0x0000000000470000-0x00000000004B9000-memory.dmp

    Filesize

    292KB

  • memory/2556-26-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB

  • memory/2976-25-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB

  • memory/2976-28-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB

  • memory/2976-29-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB