Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    06/07/2024, 17:33

General

  • Target

    2904057e868e47480cac8f07c5f59bcb_JaffaCakes118.exe

  • Size

    262KB

  • MD5

    2904057e868e47480cac8f07c5f59bcb

  • SHA1

    bcc15f5754939ebf738f0013c41c4b3760862c60

  • SHA256

    4c4288fbd816258ac59218e37c68e4974fb79e030a9118947ced3bbee6c96a6e

  • SHA512

    9ae510ce70b00beaa769ec47ff5fdc4c3f8c41a5f524323d9042ca6d07bfd53c84024f8fa70c82cedecb1606d2e9c8b1736a28afa1a2383da4f6f73c599014d5

  • SSDEEP

    6144:Uwf1c+G/3K/IkaKqCcVgdWBDcY+/OGExrrQ:UQmh/a/IhOcydMR+/OG6rQ

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2904057e868e47480cac8f07c5f59bcb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2904057e868e47480cac8f07c5f59bcb_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2268

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2268-0-0x00000000005B0000-0x00000000005FA000-memory.dmp

    Filesize

    296KB

  • memory/2268-1-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2268-13-0x0000000001F40000-0x0000000001FF2000-memory.dmp

    Filesize

    712KB

  • memory/2268-11-0x0000000001F40000-0x0000000001FF2000-memory.dmp

    Filesize

    712KB

  • memory/2268-14-0x0000000000400000-0x00000000005AF000-memory.dmp

    Filesize

    1.7MB

  • memory/2268-9-0x0000000001F40000-0x0000000001FF2000-memory.dmp

    Filesize

    712KB

  • memory/2268-7-0x0000000001F40000-0x0000000001FF2000-memory.dmp

    Filesize

    712KB

  • memory/2268-5-0x0000000001F40000-0x0000000001FF2000-memory.dmp

    Filesize

    712KB

  • memory/2268-3-0x0000000001F40000-0x0000000001FF2000-memory.dmp

    Filesize

    712KB

  • memory/2268-15-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-17-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-19-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-41-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-54-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-42-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-46-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-45-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-44-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-43-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-50-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-49-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-48-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-47-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-87-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-86-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-85-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-84-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-83-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-82-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-81-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-80-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-79-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-78-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-77-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-76-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-75-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-74-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-73-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-72-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-71-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-70-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-69-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-68-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-67-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-66-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-65-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-64-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-63-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-62-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-61-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-60-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-59-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-58-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-57-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-56-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-55-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-53-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-52-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-51-0x0000000002640000-0x00000000026F8000-memory.dmp

    Filesize

    736KB

  • memory/2268-159-0x00000000005B0000-0x00000000005FA000-memory.dmp

    Filesize

    296KB

  • memory/2268-161-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB