Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

3747b8d5a1...18.exe

windows7-x64

7

3747b8d5a1...18.exe

windows10-2004-x64

7

$PLUGINSDI...if.dll

windows7-x64

3

$PLUGINSDI...if.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$R1/$SYSDI...er.dll

windows7-x64

1

$R1/$SYSDI...er.dll

windows10-2004-x64

1

$R1/npuuseep.dll

windows7-x64

1

$R1/npuuseep.dll

windows10-2004-x64

3

$SYSDIR/gt...ed.dll

windows7-x64

1

$SYSDIR/gt...ed.dll

windows10-2004-x64

1

$TEMP/Baidu-ASBar.exe

windows7-x64

1

$TEMP/Baidu-ASBar.exe

windows10-2004-x64

3

$PROGRAM_F...ar.dll

windows7-x64

7

$PROGRAM_F...ar.dll

windows10-2004-x64

7

$TEMP/Goog...ed.exe

windows7-x64

1

$TEMP/Goog...ed.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    94s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2024, 01:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3747b8d5a17dd899b49d9db215062252_JaffaCakes118.exe

  • Size

    6.2MB

  • MD5

    3747b8d5a17dd899b49d9db215062252

  • SHA1

    231720f04efdc29b8354bce403d0363af0e75368

  • SHA256

    6a9089fce4d7fce05b4ec9783a529a6dc5b7b9bb7a38523ea32c135c2438f181

  • SHA512

    5af6d261d02a7e464a41ee495c174b224a20a0762207ed157b3cba47edafe67ed3e98e596455f7f1805013b0bbc016765f415db4bedf3139ecc56ffa57d8e515

  • SSDEEP

    98304:ZtNd9gHZhpXoZYD3VOwFimXLdIHEBM/LqQfbCbJjWpeeJGIVwWgo5rq:Z3vg5h2Zm3l/b+k4+QKJoeOwW9W

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\3747b8d5a17dd899b49d9db215062252_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3747b8d5a17dd899b49d9db215062252_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:3264

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsfAD96.tmp\Banner.dll
    Filesize

    4KB

    MD5

    91c9ee5005ac6cb4ec79a3b039b4c8df

    SHA1

    95a9c018b501b6697beca846a33955909c3f97be

    SHA256

    05838c8f81efbb98679010158f29cefd88a34fb1fe5d603e839dd406235ddf29

    SHA512

    41cc45a64fbe64cd83e704e87193004245f5d29f4f880921d041e5f2ceec86ca0653146e6477642eba73875b9d5f0d773b540436b19e4797def9c15d7618474b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsfAD96.tmp\InstallOptions.dll
    Filesize

    14KB

    MD5

    0dc0cc7a6d9db685bf05a7e5f3ea4781

    SHA1

    5d8b6268eeec9d8d904bc9d988a4b588b392213f

    SHA256

    8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

    SHA512

    814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsfAD96.tmp\System.dll
    Filesize

    11KB

    MD5

    00a0194c20ee912257df53bfe258ee4a

    SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

    SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsfAD96.tmp\ioSpecial.ini
    Filesize

    670B

    MD5

    688acdc353fca1d425fe94395189c259

    SHA1

    b96a99cf186acc710565c95588a71a42d7237a6a

    SHA256

    a19ca59641d886d73aebe78568833347a595b51729f9b3d6e9fb6d98e65b0226

    SHA512

    0392906886742b1cdd8f22638ca200e9d8542d346cb340432f221f44cc6ba5ca47517512ee0f4190e15384022be3451fff706d596b2ec5c2e598ce6405349217

    Download Submit

  • C:\Windows\SysWOW64\nsis_loader.dll
    Filesize

    24KB

    MD5

    cb004c514f4db290a92d0f072f6dc408

    SHA1

    49a52aac91ca5b10290872f80fcc8cca114fa6be

    SHA256

    ad0117c20a01ac779f664f2edfd7da0b8c77623e5301468c99ef6510db920a6f

    SHA512

    8d768433521eea54d3d7e274b8760f21e72c87881376299b987236bd95e7797814f71d23b2acae4b0a6d06a74b64093c993e2c3065374ed0bc678a0585cd9d98

    Download Submit