Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    06/07/2024, 23:10

General

  • Target

    298bc1c3e89daa11a16109ff174055db_JaffaCakes118.exe

  • Size

    396KB

  • MD5

    298bc1c3e89daa11a16109ff174055db

  • SHA1

    c0baef8fe380b1cc3d87975755556a6270f27e22

  • SHA256

    414c126b6c0e0a5e00672a9688101c2956784e8e2e4504f34e3e00ba4b027724

  • SHA512

    c63f8185aa973a59d09111871cf9131d52a1bac20c314e4f3ab9d60945f3966f55eb1d839d0669e7a1487f640ca3353a04880c1a0b0546fc2b114e15cc9f343d

  • SSDEEP

    6144:RbL+vSAhC15fc5t0j5Wc6lLvdwZrvvLNqd/UIPK+N9aFsQqwNj2xlxoqKtEMrzXa:5P1mEWflBwNvvJCXy+N8QzdMrzReDz

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\298bc1c3e89daa11a16109ff174055db_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\298bc1c3e89daa11a16109ff174055db_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Windows\298bc1c3e89daa11a16109ff174055db_JaffaCakes118.exe
      "C:\Windows\298bc1c3e89daa11a16109ff174055db_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\298bc1c3e89daa11a16109ff174055db_JaffaCakes118.exe

    Filesize

    396KB

    MD5

    298bc1c3e89daa11a16109ff174055db

    SHA1

    c0baef8fe380b1cc3d87975755556a6270f27e22

    SHA256

    414c126b6c0e0a5e00672a9688101c2956784e8e2e4504f34e3e00ba4b027724

    SHA512

    c63f8185aa973a59d09111871cf9131d52a1bac20c314e4f3ab9d60945f3966f55eb1d839d0669e7a1487f640ca3353a04880c1a0b0546fc2b114e15cc9f343d

  • \Users\Admin\AppData\Local\Temp\~In24200.dll

    Filesize

    30KB

    MD5

    fd25eaf8bb7724f5fd346dba3b848dbd

    SHA1

    1c0ab5e41b00412f28efa3199338f8c106662b01

    SHA256

    1e386a515f6e08c8f957cde40b247b82c29699bf93085ee95a6927b3acccf6b2

    SHA512

    db915d5e278064a4bec20ab1cb3896615c01f3aec15192656b435345bfdbaa512b4c42171b67159e847d0ac7653a89ea6bf9e2ae25894195bd95bb14e705364e

  • \Users\Admin\AppData\Local\Temp\~In24201.dll

    Filesize

    311KB

    MD5

    85d8e33b0036d0ded7322c6cc43effca

    SHA1

    c0170b19a48ce670b506cd9a54b2dd3939cf7c86

    SHA256

    495906ea6cbd76068a976784fd6a5909d4b1606a1064fb41d0aee901adb8a757

    SHA512

    7dd51e6eb80446945a9bfaa27807e7d0be8bcdce4d6979882a3c0000df921bec037df09731136c43cc887ab9fefca679641842c06a2edcf8fa182cf7ee51dd5f

  • memory/1260-10-0x0000000000400000-0x00000000004B1000-memory.dmp

    Filesize

    708KB

  • memory/1260-11-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1260-15-0x0000000001F30000-0x0000000001F81000-memory.dmp

    Filesize

    324KB

  • memory/1260-20-0x00000000003D0000-0x00000000003E7000-memory.dmp

    Filesize

    92KB

  • memory/1260-21-0x0000000000400000-0x00000000004B1000-memory.dmp

    Filesize

    708KB

  • memory/1260-22-0x0000000001F30000-0x0000000001F81000-memory.dmp

    Filesize

    324KB

  • memory/1616-9-0x0000000003440000-0x00000000034F1000-memory.dmp

    Filesize

    708KB

  • memory/1616-0-0x0000000000400000-0x00000000004B1000-memory.dmp

    Filesize

    708KB

  • memory/1616-17-0x0000000000400000-0x00000000004B1000-memory.dmp

    Filesize

    708KB

  • memory/1616-2-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB