Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    12s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    14/07/2024, 03:19

General

  • Target

    44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe

  • Size

    191KB

  • MD5

    44135b120caaff8964a9e4aa6e8411a8

  • SHA1

    9428d2f3a47cff0fbdf6d165d3795acfd435b65c

  • SHA256

    5ffe33e7a37d5aa852d8cd372446a119155b455bac1ee3a1daf58cb0ebaeb598

  • SHA512

    86d2ed02688ed13f405a1cbd15ab41a34c8f48f3c921c45eac11b0ea9b2a51ebbc89f814477245ec6123f82ad0c975b9dbfdffc504c7745f13ec12db61daec75

  • SSDEEP

    3072:W5nG+UAk//Qge7LnM2xroN/gKEES4zVvr1r9NB+dCHPcdHyz04:W5G1AkQ97LnHxsoK3lJd9usPcdHyz04

Score
8/10

Malware Config

Signatures

  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\44135b120caaff8964a9e4aa6e8411a8_JaffaCakes118.exe"
    1⤵
    • Server Software Component: Terminal Services DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2512
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1364

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\perfcon004.dat

    Filesize

    218B

    MD5

    a70c645ac2373a3fe7957dc11d680cd4

    SHA1

    37573bbcfddc23dd16c8de20893462f346e40dfe

    SHA256

    202e48928f997589982472b965865e31cc717561ac661eaaf511cffff4a374a9

    SHA512

    023aba52898e24af864ad0b14344427c6c0202266fab1ee2adbb53435321ae787729b4654a00c226d053abd6144fa792246087d07c107885f4f8629078bf0657

  • \??\c:\windows\SysWOW64\twain_32.dll

    Filesize

    331KB

    MD5

    2d4c240fd5ff62ffda4e345d8d72e453

    SHA1

    7e80a7b012ed4aedfd9f92470941e95ea1bd6da6

    SHA256

    993206550ff37304c403f3b60615da21615af5a33ecc8242126f6e13dcac0551

    SHA512

    d331225e4b3e1006b20a557c1e959189ce21c70a811eab120fe5061f4931ae32ce37c124741dbebe9a9ca766920f7b53084762b40f1accf8743d4b20b13a9b4c

  • memory/1364-8-0x0000000000200000-0x000000000025A000-memory.dmp

    Filesize

    360KB

  • memory/1364-11-0x0000000000200000-0x000000000025A000-memory.dmp

    Filesize

    360KB

  • memory/1364-12-0x0000000000200000-0x000000000025A000-memory.dmp

    Filesize

    360KB

  • memory/1364-13-0x0000000000200000-0x000000000025A000-memory.dmp

    Filesize

    360KB

  • memory/1364-15-0x0000000000200000-0x000000000025A000-memory.dmp

    Filesize

    360KB

  • memory/2512-1-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2512-0-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2512-2-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2512-9-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB