Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 01:23

General

  • Target

    2a7ce456c89135b618e6ed1676fb3343_JaffaCakes118.exe

  • Size

    627KB

  • MD5

    2a7ce456c89135b618e6ed1676fb3343

  • SHA1

    f41fd8a1a8621da9f1e5e06f44500b9954312931

  • SHA256

    1b0f0d106c3d4b0a3b05c4cb41f9966b5bb5122fd06b3e4ef0b31547f8e17209

  • SHA512

    ae3ccdde0f83a4f2706c98d85b9d474364ff536c00b81ebada307579848c50bae248e6fe3e0a0194a4030530c0c8555362982647fabc6ffea79970eff525bbbb

  • SSDEEP

    12288:UsAqMGHGSX1388BxGVI43GVpinJMcODu5OcQ9F9zKnXDX24mrfaqg+NH:UsBbW1SaR7QIXDm4mrfagx

Score
8/10

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a7ce456c89135b618e6ed1676fb3343_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2a7ce456c89135b618e6ed1676fb3343_JaffaCakes118.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:600
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Modifies registry class
      PID:2452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\concp32.exe

    Filesize

    637KB

    MD5

    41778941f24cdffe409008e2b641301f

    SHA1

    765a3718c3c496f22259e85705f195cef25fb706

    SHA256

    262210a61a606f94d1000e99b2054cd9407c024341c4de5a906ad57c0d72bb03

    SHA512

    137f5406b66b71ade0be38dd1d7030bc2d302b5dbc6a91765ffa15ad9bd1c0095ecdc01773877f16700ea0cf30b37a1509268d6bb80765c8b344f62781b2bb6b

  • C:\Windows\svchost.exe

    Filesize

    632KB

    MD5

    20a32841def0bc9c40c230611296675f

    SHA1

    c8cd23d993d7c5280f65a32981d94bd7297ee532

    SHA256

    fc153f84ccde26194f963fc578469e66d5afa87a79280ba40f19b6efb20da3b1

    SHA512

    75ac5dc3f6540351810494fc32f48bd0e33ee6ace20a41466ef11dd6fe1342918b076f0536805c38fff806f688bd825ef3387d6132af172ae86e7712dcc7c174

  • memory/600-0-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/600-14-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2452-15-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB