Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10/07/2024, 09:32

General

  • Target

    342a796a98083a08a0be19c80926e48c_JaffaCakes118.exe

  • Size

    320KB

  • MD5

    342a796a98083a08a0be19c80926e48c

  • SHA1

    bc01a82c40d2e3d537cdf71cc081da365fbd3dff

  • SHA256

    e25d703ceb160f24d1d9e37244de90f4406b818a4510286b052b977564bc03f8

  • SHA512

    e7ee2cf93047894df82c586d968c73ca863c57593f052adce40b892dfd650971f3113bd853e4dd5df1bc438d3b3ce03d78109a94c73d6c0e808e859630cdd5f2

  • SSDEEP

    6144:eLyKI//d8xgN3+E9xz3DfQr1w2O6EU02DPp9nrg5G35aJevhRGGhfZkEscw0LDNv:ABg9+EDEnhtHAJevHsEscw0Lhv

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\342a796a98083a08a0be19c80926e48c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\342a796a98083a08a0be19c80926e48c_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Users\Admin\dpfuoc.exe
      "C:\Users\Admin\dpfuoc.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\dpfuoc.exe

    Filesize

    320KB

    MD5

    8f4a1bb93491a2ba7f7478b9d694992f

    SHA1

    9a9de0728900b1a0a50ffe6b4340bbc5c5c5975b

    SHA256

    24a1394a15c9949ef39a413246cf01c6bc877edee84730498b05fb0d3795095e

    SHA512

    a6e0f1510d2d96047c66f2bed3b8b71230657261b40b8fa45a775fcfdbc6dd9534da00bfd20ae1e12cabf8818b3f1cbc54c3b3c0576bab09d82984da77d3bd1a