Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 09:25

General

  • Target

    411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe

  • Size

    29KB

  • MD5

    411a4a7d91a470f004c1d785320e9753

  • SHA1

    75e39c62e04fa6a97ea54794b4d3f9c24cc61ebd

  • SHA256

    0b24337084608878194c71a3dbf40a06e457b61fad024dd2fb0bfb6ad571073c

  • SHA512

    00f44891cda68af23010349568fb2b59150626a352b9e6cd6a2ee02f78ff25a0afdc2aa18679ed44aa288e980cfd4fdba2e743a58157876094dcd03759875f7f

  • SSDEEP

    768:tQbuQRy2UjmUndnlTttxDn+3jiSkjRY6AB7kKfYoJ+ifBEewj:QuQRylaUDTDxDXjy6AB7koYy23

Malware Config

Signatures

  • Windows security bypass 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 4 IoCs
  • Modifies WinLogon 2 TTPs 5 IoCs
  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:432
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1200
        • C:\Users\Admin\AppData\Local\Temp\411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe"
          2⤵
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1580
          • C:\Windows\SysWOW64\upkookuk-ced.exe
            "C:\Windows\system32\upkookuk-ced.exe"
            3⤵
            • Windows security bypass
            • Boot or Logon Autostart Execution: Active Setup
            • Event Triggered Execution: Image File Execution Options Injection
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Modifies WinLogon
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2576
            • C:\Windows\SysWOW64\upkookuk-ced.exe
              --k33p
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:320

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\afxoroax.exe

        Filesize

        32KB

        MD5

        bb3c9cf8678ac0bb2d3ea0e2429e72bf

        SHA1

        9234232f8966c88e3397772eb71e539481d6574b

        SHA256

        14eb3577f40166dacbe608c22949223c0e293f9f587b705ff857d245467a82fa

        SHA512

        a4d08f53082861496ef73e642d0fba090c5eeac04cc1c94a59737d9797e07937a13d89f4043b908b7b16f1d17ff86f2a7e8f61e0ca6a5b659e24fb519f975933

      • C:\Windows\SysWOW64\amfineac.dll

        Filesize

        5KB

        MD5

        c8521a5fdd1c9387d536f599d850b195

        SHA1

        a543080665107b7e32bcc1ed19dbfbc1d2931356

        SHA256

        fa8f77b6daf775d66de9d27c1d896168a792057358e518c00e72b8964b966ca5

        SHA512

        541500e2cd502852a007d29badc1a1848d187245f78ec272281bab290cc6e308f0ae6d1b96863e0c30a176b16c6cf7e63e08a8de81a84615e4710e7164a805cd

      • C:\Windows\SysWOW64\ulsepop.exe

        Filesize

        31KB

        MD5

        9cabf5f9fbdc9010abedbe95f8d96e28

        SHA1

        8350dc3fe198dbd1270f7ea2a7eff2923183235d

        SHA256

        474b8292d17dea28f29494423707d6a305a6df9bbe615492297935ebc86dd67a

        SHA512

        30d26f24edf83de8ecc299148e546dfe81e10c1fa594bd6d42f8549b12dc3a6b8147a1168f35005676a4fe4aabea67c56cfcc08be4a15195c2f03ae4b1e0c6d7

      • C:\Windows\SysWOW64\upkookuk-ced.exe

        Filesize

        29KB

        MD5

        411a4a7d91a470f004c1d785320e9753

        SHA1

        75e39c62e04fa6a97ea54794b4d3f9c24cc61ebd

        SHA256

        0b24337084608878194c71a3dbf40a06e457b61fad024dd2fb0bfb6ad571073c

        SHA512

        00f44891cda68af23010349568fb2b59150626a352b9e6cd6a2ee02f78ff25a0afdc2aa18679ed44aa288e980cfd4fdba2e743a58157876094dcd03759875f7f

      • memory/320-25-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

      • memory/320-60-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

      • memory/1580-0-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

      • memory/1580-11-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

      • memory/2576-13-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

      • memory/2576-59-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB