Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    09/07/2024, 15:51

General

  • Target

    31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe

  • Size

    80KB

  • MD5

    31001c0b3294f2c79e837b414f1a2692

  • SHA1

    aecc35b151ae805431133ef465537ba05d27a807

  • SHA256

    ee8a64bd6a4006e9b567635a4f3bf1bc5f4dbd17db09167a20741965c3a2e01e

  • SHA512

    e60559a3525e4631ed735ab401b554da5910ca29fcaa203cb84837cdc38e64eb1352687eb586f10ee2f9b67c97642993f65863e7fd1c8aabc3e296c9bfe31bc4

  • SSDEEP

    1536:vvz1Q27x4i3zY/Zv5BlEStr91keFQFxyYj9mPppocy:vvx7G+zoZvNEkrOxyYj9BP

Score
8/10

Malware Config

Signatures

  • Server Software Component: Terminal Services DLL 1 TTPs 14 IoCs
  • Loads dropped DLL 24 IoCs
  • Drops file in System32 directory 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe"
    1⤵
    • Server Software Component: Terminal Services DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1760
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1952
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:2356
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:2692
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:2924
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:2572
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:3032
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1628
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
      PID:1000
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:2444
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:2756
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:2884
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:2864
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:2108

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

      Filesize

      80KB

      MD5

      8e0ec0e8732cc36927f1f3efb2e941b6

      SHA1

      eed568c9b9a491109de09cd58ea257186b5a3d47

      SHA256

      b5e81fd07e16c2032ed8ba259d90ffa6d5ec4e4de792a1f38bd7b1abcdbb52e5

      SHA512

      1cdb57549afcd0890e9622f5b29694f7c7ac11ca902c980ad9375d46b77216ef080c338bb5f91dcc4e121aadc50bb23d3a7bd570d318be091f3fa188600b8c37

    • memory/1628-44-0x0000000074B70000-0x0000000074B90000-memory.dmp

      Filesize

      128KB

    • memory/1760-23-0x0000000000020000-0x0000000000040000-memory.dmp

      Filesize

      128KB

    • memory/1760-0-0x0000000000F60000-0x0000000000F80000-memory.dmp

      Filesize

      128KB

    • memory/1760-1-0x0000000000020000-0x0000000000040000-memory.dmp

      Filesize

      128KB

    • memory/1760-2-0x0000000000020000-0x0000000000040000-memory.dmp

      Filesize

      128KB

    • memory/1760-4-0x0000000000F7F000-0x0000000000F80000-memory.dmp

      Filesize

      4KB

    • memory/1760-17-0x0000000000F60000-0x0000000000F80000-memory.dmp

      Filesize

      128KB

    • memory/1952-9-0x0000000074B70000-0x0000000074B90000-memory.dmp

      Filesize

      128KB

    • memory/2356-16-0x0000000074610000-0x0000000074630000-memory.dmp

      Filesize

      128KB

    • memory/2356-14-0x0000000074630000-0x0000000074650000-memory.dmp

      Filesize

      128KB

    • memory/2444-52-0x0000000074B70000-0x0000000074B90000-memory.dmp

      Filesize

      128KB

    • memory/2572-34-0x0000000074B70000-0x0000000074B90000-memory.dmp

      Filesize

      128KB

    • memory/2572-35-0x0000000074B50000-0x0000000074B70000-memory.dmp

      Filesize

      128KB

    • memory/2692-22-0x0000000074B50000-0x0000000074B70000-memory.dmp

      Filesize

      128KB

    • memory/2756-58-0x0000000074B70000-0x0000000074B90000-memory.dmp

      Filesize

      128KB

    • memory/2864-68-0x0000000074B70000-0x0000000074B90000-memory.dmp

      Filesize

      128KB

    • memory/2884-62-0x0000000074B70000-0x0000000074B90000-memory.dmp

      Filesize

      128KB

    • memory/2924-28-0x0000000074B70000-0x0000000074B90000-memory.dmp

      Filesize

      128KB

    • memory/3032-39-0x0000000074B70000-0x0000000074B90000-memory.dmp

      Filesize

      128KB