Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 20:39

General

  • Target

    2db86f4331060dde01d8e6da4d006632_JaffaCakes118.exe

  • Size

    100KB

  • MD5

    2db86f4331060dde01d8e6da4d006632

  • SHA1

    556bff46ce0840844b9b85d52a4a8521b2215907

  • SHA256

    2f27e76b9d5a0961e49d4e5de6153e981075f1724b7b1cb2669723e8dc843dbd

  • SHA512

    a0362ad8b1ae4e94571963a95ca476f2bb43e23f935da79bb490586c3c88cc2963ae5d8fa4aa91566e8661bcf1e1ce59b75f44a1188b7cb92a94ecc8e7aa781f

  • SSDEEP

    1536:WqtGR82NTzwTqMGAc4ohrPXo+73Rez8b0SyuNIjnZq:4wTNurPX7CuCnY

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2db86f4331060dde01d8e6da4d006632_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2db86f4331060dde01d8e6da4d006632_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Users\Admin\vzxiuv.exe
      "C:\Users\Admin\vzxiuv.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\vzxiuv.exe

    Filesize

    100KB

    MD5

    978ff06245ace5eed4e6fc1760d3e284

    SHA1

    ea2ba8192f30b1ebf11ac93d255eef2009043242

    SHA256

    12765ae2648b9a9ef02249c47e30b0925b36300bd28329f39acdb3096e3ec607

    SHA512

    02a589fe37fb0954b9cb257cad5b625db9d38052d81d2e057ea8e577f790f8d55c8875b16a71c799fd2632be0f76269f5759410eca57fff189461cde5d7cdaa4