Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    11/07/2024, 01:59

General

  • Target

    3747b8d5a17dd899b49d9db215062252_JaffaCakes118.exe

  • Size

    6.2MB

  • MD5

    3747b8d5a17dd899b49d9db215062252

  • SHA1

    231720f04efdc29b8354bce403d0363af0e75368

  • SHA256

    6a9089fce4d7fce05b4ec9783a529a6dc5b7b9bb7a38523ea32c135c2438f181

  • SHA512

    5af6d261d02a7e464a41ee495c174b224a20a0762207ed157b3cba47edafe67ed3e98e596455f7f1805013b0bbc016765f415db4bedf3139ecc56ffa57d8e515

  • SSDEEP

    98304:ZtNd9gHZhpXoZYD3VOwFimXLdIHEBM/LqQfbCbJjWpeeJGIVwWgo5rq:Z3vg5h2Zm3l/b+k4+QKJoeOwW9W

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3747b8d5a17dd899b49d9db215062252_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3747b8d5a17dd899b49d9db215062252_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: GetForegroundWindowSpam
    PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsjD470.tmp\ioSpecial.ini

    Filesize

    631B

    MD5

    651fdaa81686612bd9e4c84ca60bbbae

    SHA1

    3a2681989d404786c3b8f7bf5ac0257481aa9e89

    SHA256

    a9ea2e8686f61acba1aedd6d8dc9c9c2b594a5bf5914337b9c5e82773d523f2d

    SHA512

    0cab7efff701c23fc74039ed8b9d51b95ac4a734f68c6ae789cb8188e0d30fa5a8f3248178d552708af42b05a91cfd673971b6b0b381e73a19cc7907db1429a5

  • C:\Users\Admin\AppData\Local\Temp\nsjD470.tmp\ioSpecial.ini

    Filesize

    670B

    MD5

    1ef5d33a5bf6ba20af7680a3d6021392

    SHA1

    dafa85b151dda2f215a414d4986ec23a5d02b1e4

    SHA256

    a3d87b6ca3122c6a3d6eadafac1d5372a353b1bac3160f07d5c7669c8067b3d2

    SHA512

    af1f777cfe9f5aadac4c62bb19eefb230f59211800ac839620fc97b35ebec7335998a5df706ae5b0baea744f9d4583ca632ca426cbbb662db321a69cca053981

  • \Users\Admin\AppData\Local\Temp\nsjD470.tmp\Banner.dll

    Filesize

    4KB

    MD5

    91c9ee5005ac6cb4ec79a3b039b4c8df

    SHA1

    95a9c018b501b6697beca846a33955909c3f97be

    SHA256

    05838c8f81efbb98679010158f29cefd88a34fb1fe5d603e839dd406235ddf29

    SHA512

    41cc45a64fbe64cd83e704e87193004245f5d29f4f880921d041e5f2ceec86ca0653146e6477642eba73875b9d5f0d773b540436b19e4797def9c15d7618474b

  • \Users\Admin\AppData\Local\Temp\nsjD470.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    0dc0cc7a6d9db685bf05a7e5f3ea4781

    SHA1

    5d8b6268eeec9d8d904bc9d988a4b588b392213f

    SHA256

    8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

    SHA512

    814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

  • \Users\Admin\AppData\Local\Temp\nsjD470.tmp\System.dll

    Filesize

    11KB

    MD5

    00a0194c20ee912257df53bfe258ee4a

    SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

    SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

  • \Windows\SysWOW64\nsis_loader.dll

    Filesize

    24KB

    MD5

    cb004c514f4db290a92d0f072f6dc408

    SHA1

    49a52aac91ca5b10290872f80fcc8cca114fa6be

    SHA256

    ad0117c20a01ac779f664f2edfd7da0b8c77623e5301468c99ef6510db920a6f

    SHA512

    8d768433521eea54d3d7e274b8760f21e72c87881376299b987236bd95e7797814f71d23b2acae4b0a6d06a74b64093c993e2c3065374ed0bc678a0585cd9d98