Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09/07/2024, 01:00

General

  • Target

    2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe

  • Size

    594KB

  • MD5

    2e75b43271573a2d36d9160d9595ea12

  • SHA1

    1975a342a3b35a7047b0e9ff9f193f5b7d1b1f9a

  • SHA256

    3e30f0af7c7899a7c7aea62ba6ca70e2324896c8a935df4e4515941812f71104

  • SHA512

    bea9c55a964c8b2fa7884cc8ec6dc60da868601e8a7b061a17066a8bff0463f74713cac7fabb3a2e75862af8afb1dd22e7a99884821cfc68267d9bd5e03eb16b

  • SSDEEP

    12288:D5XiRHau4V/4HOV9eoNqcF3Z4mxxaDqVTVOCqup:1Xiau4V/UdoNDQmXhVTzH

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\Delete.bat
      2⤵
      • Deletes itself
      PID:2820
  • C:\Windows\G_Server1.23.exe
    C:\Windows\G_Server1.23.exe
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
        PID:2592

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Delete.bat

      Filesize

      214B

      MD5

      7ea2e20ef70ae4eb4ca5e7cf9e2e62c1

      SHA1

      b84fc68f869e8db5c4226bce93c271dcc7c4e2c4

      SHA256

      c873f497ba476fb633221c01f60143823d4286f47682417f2424a02424fce358

      SHA512

      ef147a0ec59b8d114b1c4ba5ed89ca5d6cfdab31ef425c857715f2ccd7aa4332c4ad1670a71089f87ebad24d09186f1eceb00b7cda05118b6f320cfc1c782fc9

    • C:\Windows\G_Server1.23.exe

      Filesize

      594KB

      MD5

      2e75b43271573a2d36d9160d9595ea12

      SHA1

      1975a342a3b35a7047b0e9ff9f193f5b7d1b1f9a

      SHA256

      3e30f0af7c7899a7c7aea62ba6ca70e2324896c8a935df4e4515941812f71104

      SHA512

      bea9c55a964c8b2fa7884cc8ec6dc60da868601e8a7b061a17066a8bff0463f74713cac7fabb3a2e75862af8afb1dd22e7a99884821cfc68267d9bd5e03eb16b

    • memory/2680-36-0x0000000000400000-0x0000000000507000-memory.dmp

      Filesize

      1.0MB

    • memory/2680-33-0x0000000000400000-0x0000000000507000-memory.dmp

      Filesize

      1.0MB

    • memory/2680-21-0x0000000000400000-0x0000000000507000-memory.dmp

      Filesize

      1.0MB

    • memory/3052-17-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/3052-5-0x0000000000540000-0x0000000000541000-memory.dmp

      Filesize

      4KB

    • memory/3052-16-0x0000000000280000-0x0000000000281000-memory.dmp

      Filesize

      4KB

    • memory/3052-15-0x0000000000270000-0x0000000000271000-memory.dmp

      Filesize

      4KB

    • memory/3052-13-0x00000000034B0000-0x00000000034B1000-memory.dmp

      Filesize

      4KB

    • memory/3052-12-0x00000000033B0000-0x00000000033B3000-memory.dmp

      Filesize

      12KB

    • memory/3052-11-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/3052-14-0x0000000003400000-0x0000000003401000-memory.dmp

      Filesize

      4KB

    • memory/3052-6-0x0000000000530000-0x0000000000531000-memory.dmp

      Filesize

      4KB

    • memory/3052-0-0x0000000000400000-0x0000000000507000-memory.dmp

      Filesize

      1.0MB

    • memory/3052-4-0x00000000005F0000-0x00000000005F1000-memory.dmp

      Filesize

      4KB

    • memory/3052-3-0x0000000000560000-0x0000000000561000-memory.dmp

      Filesize

      4KB

    • memory/3052-2-0x0000000000580000-0x0000000000581000-memory.dmp

      Filesize

      4KB

    • memory/3052-10-0x0000000000550000-0x0000000000551000-memory.dmp

      Filesize

      4KB

    • memory/3052-7-0x00000000005E0000-0x00000000005E1000-memory.dmp

      Filesize

      4KB

    • memory/3052-8-0x0000000000590000-0x0000000000591000-memory.dmp

      Filesize

      4KB

    • memory/3052-30-0x0000000000400000-0x0000000000507000-memory.dmp

      Filesize

      1.0MB

    • memory/3052-31-0x0000000000360000-0x00000000003B4000-memory.dmp

      Filesize

      336KB

    • memory/3052-9-0x0000000000600000-0x0000000000601000-memory.dmp

      Filesize

      4KB

    • memory/3052-1-0x0000000000360000-0x00000000003B4000-memory.dmp

      Filesize

      336KB