Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    12/07/2024, 10:09

General

  • Target

    3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe

  • Size

    56KB

  • MD5

    3cf230799087ac116b3d5361594b7593

  • SHA1

    5f7675a405c7cfa54b41278381ea5e7910df1faa

  • SHA256

    2602236c997150500682aa1e05b1e879f46c81ae220a2be8c691ffd9bccf15db

  • SHA512

    0fe869a1925de69923e3a740327d6801419dc01e6bdf38d0d0658281a4fd2c77b4ee34b76d9492f768e8aaec87311a6187210d290291f16ce50dd8daa001cd8b

  • SSDEEP

    768:HM3tgIxw3mHxemBUMLnmzzQxINFIk2d+1FIkRc7NKecMkNYn6WyzZspG6P8Lx4Ns:HMNoFH7ShdLw00NMyBq6ZxH0P6D555o

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 51 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Users\Admin\woeogo.exe
      "C:\Users\Admin\woeogo.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\woeogo.exe

    Filesize

    56KB

    MD5

    87ca7f911b1e00cc0370aa4e3535357e

    SHA1

    81e5b0c3175d9e7f94dc04852317c86c4d99e6fa

    SHA256

    a75deb13df829da3c10ddd60694cf287e92f995e72bf802433b1e3edd6a85e99

    SHA512

    c0063a0ab306ca11a6417a7628eda008afa35c91f6ca8df2ff8e00f0e3eaaf0aad89d98c03b552f283d876a905f253911877164c293f7201a0a138075c5475c0