Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    09/07/2024, 06:26

General

  • Target

    2f4bf16670b3f9335d9fcf68e1e473a3_JaffaCakes118.exe

  • Size

    189KB

  • MD5

    2f4bf16670b3f9335d9fcf68e1e473a3

  • SHA1

    dbe876957121dde5f0d73b496cf8f68accd1962c

  • SHA256

    6d415d88150eee9e16f11bfefc0b651ff7016bfb7beed878dadcd7c8df55b862

  • SHA512

    8a2ee7228d0924a53c1e9f5e4250e4ebcfc12e8c0240a6d8995d0ce5d807179493522059554f7f241222f8502878c9e393e35ef7f56275de180e45bcacf88ac5

  • SSDEEP

    3072:NnWe1jbeWHSOPdIuG8UvahsdcYX3UI2EuJ3im/ZCdady+RlTp/VYq63+sU:NWepbZfPBUyhsdEI2++M+RlTHYW

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f4bf16670b3f9335d9fcf68e1e473a3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2f4bf16670b3f9335d9fcf68e1e473a3_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\MSWINSCK.OCX

    Filesize

    121KB

    MD5

    e8a2190a9e8ee5e5d2e0b599bbf9dda6

    SHA1

    4e97bf9519c83835da9db309e61ec87ddf165167

    SHA256

    80ab0b86de58a657956b2a293bd9957f78e37e7383c86d6cd142208c153b6311

    SHA512

    57f8473eedaf7e8aad3b5bcbb16d373fd6aaec290c3230033fc50b5ec220e93520b8915c936e758bb19107429a49965516425350e012f8db0de6d4f6226b42ee

  • memory/1596-0-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB