Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    10/07/2024, 10:26

General

  • Target

    3457ee2b683f0408eaf44e2c51382a10_JaffaCakes118.exe

  • Size

    57KB

  • MD5

    3457ee2b683f0408eaf44e2c51382a10

  • SHA1

    b2da65fcf01e130f9aed9c87889622fab35cc834

  • SHA256

    220b92870d450da5f61290b49f71694a4fb499c7545376c6a77fec260144cade

  • SHA512

    c93a63ac379be0654bb160ed8e2dbdd29632c7e574c6ff038d0de415d5bff30b69573aeacb09d3dd3c88d48b9a62c1f6c043102526877fb41821fdc5a299f5bd

  • SSDEEP

    768:/PE4Nc2avjygCkrh3lbOfovo6qAHVUBM8j5/PrL8u4557acjfpPQxy0AHt:/PN2ykrh39moga6O8j1Prm5xaIQxNIt

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3457ee2b683f0408eaf44e2c51382a10_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3457ee2b683f0408eaf44e2c51382a10_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:300
    • C:\Users\Admin\AppData\Local\Temp\SErviCes.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\SErviCes.exe.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:864
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 36
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2240

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\SErviCes.exe.exe

    Filesize

    29KB

    MD5

    a9f909076bdf0b333fc064a8154782f7

    SHA1

    f9a6058d2bd617f72564d87ca27695f26fe9ed45

    SHA256

    0c06eed1863ebbc160308abd2d39817e6b9c0820dadfdac50dc5b8fd3d27064b

    SHA512

    d074f8e2ea559437f34487f2d9caf3afee3a5b46a0f2c31d6e34e54e069d8f2f5e6b14d59053bada9ddd31bff64927e052d0f1eb8fba402e877b67756f2b5da2

  • memory/300-6-0x0000000002890000-0x0000000002899000-memory.dmp

    Filesize

    36KB

  • memory/300-12-0x0000000002890000-0x0000000002899000-memory.dmp

    Filesize

    36KB

  • memory/864-13-0x0000000000400000-0x00000000004083A0-memory.dmp

    Filesize

    32KB