Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 21:03

General

  • Target

    4354ae5294f09261ab5678fb2221c9c0_JaffaCakes118.exe

  • Size

    220KB

  • MD5

    4354ae5294f09261ab5678fb2221c9c0

  • SHA1

    dd342a6245254bd73a49b23b8ef93aa0e28e2d1c

  • SHA256

    29fcc132c41cddc2dcd9429e31f4aabb7283c53ebdd9c1a9409f7123bbcde850

  • SHA512

    fe9bda763ffa3ed7f12779baec04211dc78cf8f4ab5243e6630eeb15c3ff62c225a195f7d75d265ffb1770bb70764549a1a7fe73e428a3a853bca9e580dbc2b7

  • SSDEEP

    3072:VuS3u8KLoPLjmRTSXPUkdXz9qJ7MNDsZpznTWPiaFSeSGPFcPRP8RMYym6IWEgDf:sVWLjuIBz98LPq0iRMYymRWFD

Score
7/10

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies WinLogon 2 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4354ae5294f09261ab5678fb2221c9c0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4354ae5294f09261ab5678fb2221c9c0_JaffaCakes118.exe"
    1⤵
    • Checks BIOS information in registry
    • Modifies WinLogon
    • Suspicious use of AdjustPrivilegeToken
    PID:2824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2824-0-0x0000000000220000-0x0000000000272000-memory.dmp

    Filesize

    328KB

  • memory/2824-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2824-4-0x0000000002410000-0x00000000024BA000-memory.dmp

    Filesize

    680KB

  • memory/2824-6-0x0000000002410000-0x00000000024BA000-memory.dmp

    Filesize

    680KB

  • memory/2824-2-0x0000000002410000-0x00000000024BA000-memory.dmp

    Filesize

    680KB

  • memory/2824-10-0x0000000002410000-0x00000000024BA000-memory.dmp

    Filesize

    680KB

  • memory/2824-12-0x0000000002410000-0x00000000024BA000-memory.dmp

    Filesize

    680KB

  • memory/2824-8-0x0000000002410000-0x00000000024BA000-memory.dmp

    Filesize

    680KB

  • memory/2824-13-0x0000000000400000-0x00000000004FA000-memory.dmp

    Filesize

    1000KB

  • memory/2824-14-0x00000000025C0000-0x0000000002678000-memory.dmp

    Filesize

    736KB

  • memory/2824-19-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2824-42-0x0000000001F50000-0x0000000001F51000-memory.dmp

    Filesize

    4KB

  • memory/2824-59-0x00000000025C0000-0x0000000002678000-memory.dmp

    Filesize

    736KB

  • memory/2824-58-0x00000000026E0000-0x00000000026E1000-memory.dmp

    Filesize

    4KB

  • memory/2824-56-0x00000000026C0000-0x00000000026C1000-memory.dmp

    Filesize

    4KB

  • memory/2824-55-0x00000000026D0000-0x00000000026D1000-memory.dmp

    Filesize

    4KB

  • memory/2824-52-0x00000000026C0000-0x00000000026C1000-memory.dmp

    Filesize

    4KB

  • memory/2824-51-0x0000000002020000-0x0000000002021000-memory.dmp

    Filesize

    4KB

  • memory/2824-49-0x0000000002000000-0x0000000002001000-memory.dmp

    Filesize

    4KB

  • memory/2824-48-0x0000000002010000-0x0000000002011000-memory.dmp

    Filesize

    4KB

  • memory/2824-45-0x0000000002000000-0x0000000002001000-memory.dmp

    Filesize

    4KB

  • memory/2824-44-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

    Filesize

    4KB

  • memory/2824-41-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

    Filesize

    4KB

  • memory/2824-37-0x0000000001F40000-0x0000000001F41000-memory.dmp

    Filesize

    4KB

  • memory/2824-35-0x0000000000940000-0x0000000000941000-memory.dmp

    Filesize

    4KB

  • memory/2824-34-0x0000000000950000-0x0000000000951000-memory.dmp

    Filesize

    4KB

  • memory/2824-31-0x0000000000940000-0x0000000000941000-memory.dmp

    Filesize

    4KB

  • memory/2824-30-0x00000000006E0000-0x00000000006E1000-memory.dmp

    Filesize

    4KB

  • memory/2824-28-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2824-27-0x00000000006D0000-0x00000000006D1000-memory.dmp

    Filesize

    4KB

  • memory/2824-24-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2824-23-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2824-21-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2824-20-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2824-17-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2824-16-0x00000000025C0000-0x0000000002678000-memory.dmp

    Filesize

    736KB

  • memory/2824-62-0x0000000000220000-0x0000000000272000-memory.dmp

    Filesize

    328KB

  • memory/2824-63-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB