Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    09/07/2024, 06:11

General

  • Target

    2f416b7a58deefb212e5c07fe73139dd_JaffaCakes118.exe

  • Size

    2.7MB

  • MD5

    2f416b7a58deefb212e5c07fe73139dd

  • SHA1

    bd8d4f6d8d6e12f08376ba547215d30834ff91ca

  • SHA256

    13e8616673a37715f239a90c459060f3388b577bef7e58f20f50295a0f9e703c

  • SHA512

    7f76f706e8a0b96053a31e75ffdc9749304ec41ccd05513f739420032a52d09a485602dfa10d29e9e143ea5b3a83c5090469845764986dd598c9f5927126344d

  • SSDEEP

    49152:gh+rY6QBxj3stByLy1JmzOkXQmdJr3CeI4qY/OciLq26EhIE0f9eIleHOKAGXxB7:b4ytMmJmzTgmP3n1q2PYz6II1oKaOP0L

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f416b7a58deefb212e5c07fe73139dd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2f416b7a58deefb212e5c07fe73139dd_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2152

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nst45B9.tmp\ioSpecial.ini

    Filesize

    619B

    MD5

    b1b64294efcac1e8f00f097781c1be91

    SHA1

    3c2e0d153391c799b7aa38e8a37b084dc9f04ec0

    SHA256

    716f16bb87b5a8b914a47e3a35bacd980ba576eb11df05956826eecf62da365e

    SHA512

    23decfdb470dd16b4b0474daef25ce2098670e7fd420672fe761aef3164ec1ffc3e310c08e334f404713805633625ec4215fb8f9eed0e0aec3458d8411a494d6

  • \Users\Admin\AppData\Local\Temp\nst45B9.tmp\BrandingURL.dll

    Filesize

    4KB

    MD5

    71c46b663baa92ad941388d082af97e7

    SHA1

    5a9fcce065366a526d75cc5ded9aade7cadd6421

    SHA256

    bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

    SHA512

    5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

  • \Users\Admin\AppData\Local\Temp\nst45B9.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    0dc0cc7a6d9db685bf05a7e5f3ea4781

    SHA1

    5d8b6268eeec9d8d904bc9d988a4b588b392213f

    SHA256

    8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

    SHA512

    814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0