Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    10/07/2024, 19:31

General

  • Target

    361486f6bd20657d7271e659098a828d_JaffaCakes118.exe

  • Size

    26KB

  • MD5

    361486f6bd20657d7271e659098a828d

  • SHA1

    76eb46ef6725e360b4b96072a70bc2968ac47c93

  • SHA256

    534eb8df542c570aa614f86e6b58875ef5a3f5cd95a206832969eeaf038d633d

  • SHA512

    84ebbba845bdaf1a819e5db16700668d002aa32323349672d83ec1408a4cbe8d10d7fa23321957c5aace7dcb3bcfb2976accec03a3cd989d079acefeb4846f1a

  • SSDEEP

    384:uLzeXxIfYSBrkzdfcTZk4EOzOqfmjDDsF8FY1HbFBf83LuP/:oe0YSddLC0isFV1pa3La

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    1⤵
      PID:600
    • C:\Users\Admin\AppData\Local\Temp\361486f6bd20657d7271e659098a828d_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\361486f6bd20657d7271e659098a828d_JaffaCakes118.exe"
      1⤵
      • Modifies WinLogon for persistence
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" %1
        2⤵
          PID:2072

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/600-5-0x00000000001D0000-0x00000000001D8000-memory.dmp

        Filesize

        32KB

      • memory/2516-2-0x0000000000401000-0x0000000000408000-memory.dmp

        Filesize

        28KB

      • memory/2516-1-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB

      • memory/2516-6-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB

      • memory/2516-7-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB

      • memory/2516-8-0x0000000000401000-0x0000000000408000-memory.dmp

        Filesize

        28KB

      • memory/2516-18-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB