Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    09/07/2024, 19:14

General

  • Target

    31a2522b691819aef0777f5d3ad8b822_JaffaCakes118.exe

  • Size

    138KB

  • MD5

    31a2522b691819aef0777f5d3ad8b822

  • SHA1

    76dfc3ed82135589595c1839ea6513537b2c87e2

  • SHA256

    1e220ae5de5671e1383f6a793621dc30f3be1553c3496a61ca99f1b0d39f0dce

  • SHA512

    64038ce72198e081b5127b5b36fdb9d8a5f441866191c617a25334841846477540b7b4b4640eaf632e3712bb8e7222bd6a8b2edf9171f6d16a5db529e7519f02

  • SSDEEP

    3072:bVOmv3843n6MGIIznDLBNR3X4Zngtybpq:bgU84yVLBNRYZgm

Score
8/10

Malware Config

Signatures

  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\31a2522b691819aef0777f5d3ad8b822_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\31a2522b691819aef0777f5d3ad8b822_JaffaCakes118.exe"
    1⤵
    • Server Software Component: Terminal Services DLL
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2064
  • C:\Windows\SysWOW64\Svchost.exe
    C:\Windows\SysWOW64\Svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:2364

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Infotmp.txt

    Filesize

    724B

    MD5

    ccc785e44d84c30da8f9a5ef427d6b69

    SHA1

    eea24ece060e13cb2bcbf81f7d61e6ea7ee34fba

    SHA256

    38fc8626e8538aa853d5e3559eb488ccc3b1df16e63647498b9b25100a047635

    SHA512

    a45f872e19c2092f02a3d9e253cf6f7de2c7a454f15f983d031d113e79a1cfa607055376e82d368b8b61b074e8e0496751f50ebba8d314bbca4e816f418d0f09

  • \Windows\SysWOW64\3E5704AC.tmp

    Filesize

    138KB

    MD5

    3130622b2b74522d31ad36c92e8cd512

    SHA1

    f8e6fec47fee76372a82dd78c47eab45fef5c6c8

    SHA256

    1c22f9d1a389245cd9ee4588ef39c7f8ad7c1eda5283b18daf551013c76658d5

    SHA512

    0b06ac1aca37b6b0d7eb1c5c0523ba920109588b9174b2f06829e16d6533575dcae562fa24a4438ba51f29cbbddff09f327e0f181b100aecdf1ae058ca30d8e6

  • memory/2064-0-0x0000000001110000-0x0000000001136000-memory.dmp

    Filesize

    152KB

  • memory/2064-4-0x00000000774CF000-0x00000000774D0000-memory.dmp

    Filesize

    4KB

  • memory/2064-5-0x0000000075369000-0x000000007536B000-memory.dmp

    Filesize

    8KB

  • memory/2064-14-0x0000000001110000-0x0000000001136000-memory.dmp

    Filesize

    152KB

  • memory/2364-11-0x0000000074BB0000-0x0000000074BD6000-memory.dmp

    Filesize

    152KB

  • memory/2364-13-0x0000000074BB0000-0x0000000074BD6000-memory.dmp

    Filesize

    152KB