Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    11/07/2024, 15:04

General

  • Target

    399f0dcb9aa27feb6840b352d037e076_JaffaCakes118.exe

  • Size

    37KB

  • MD5

    399f0dcb9aa27feb6840b352d037e076

  • SHA1

    c6f71ede19ed7c72155cf116c6ae1917ce669713

  • SHA256

    682baf6019363b6627b25eb0764b61a2f9a82ff39a0e506274c0a13296b80be0

  • SHA512

    774a2647ac235d349b41d5229c60ed6cc8a447eae95c4bf15c3ef29891fd8b6fab4fda0c4b3a0d4ecd7714335a8151b99ce61816e6a3f48b4ac83fc0d599221d

  • SSDEEP

    768:w2RMiIWbg81xG3tAlzfB57yRd+dkz4xWgvNn6tPfbPkT2IOinIBqKuBr:L6wtmL+W4XN6tXbPktIu

Score
10/10

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 5 IoCs
  • Drops file in System32 directory 7 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\399f0dcb9aa27feb6840b352d037e076_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\399f0dcb9aa27feb6840b352d037e076_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    PID:1924
  • C:\Windows\system\smsc.exe
    "C:\Windows\system\smsc.exe"
    1⤵
    • Modifies security service
    • Windows security bypass
    • Deletes itself
    • Executes dropped EXE
    • Windows security modification
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    PID:1932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Windows\Temp\Tar8FE6.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Windows\system\smsc.exe

    Filesize

    37KB

    MD5

    399f0dcb9aa27feb6840b352d037e076

    SHA1

    c6f71ede19ed7c72155cf116c6ae1917ce669713

    SHA256

    682baf6019363b6627b25eb0764b61a2f9a82ff39a0e506274c0a13296b80be0

    SHA512

    774a2647ac235d349b41d5229c60ed6cc8a447eae95c4bf15c3ef29891fd8b6fab4fda0c4b3a0d4ecd7714335a8151b99ce61816e6a3f48b4ac83fc0d599221d

  • memory/1924-0-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1924-6-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-63-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-66-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-60-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-61-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-62-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-4-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-65-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-59-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-67-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-68-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-69-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-70-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-71-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-72-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1932-73-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB