Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    15/07/2024, 06:58

General

  • Target

    48b4afdf7858765829821b31438b8038_JaffaCakes118.exe

  • Size

    290KB

  • MD5

    48b4afdf7858765829821b31438b8038

  • SHA1

    30b5e8d185ac21bb8d19dd43151f7dd257a9f3cc

  • SHA256

    36927e7104d99ee422c43ba14d7c4d973961f902e0156659b997111189bb4bf7

  • SHA512

    99c3c1e3c9b9eb22f968064faab86a78fec8dbee831a5b04fdc0d940951d618e3106db88ad118458cead1ad844faee6b75884a0c770e666f5632b850944e8461

  • SSDEEP

    6144:FXdlvdqWLqOKp/B5RyaynzgvGq6JhW71Qgtm0DTgJvj:FXd/zL0/B5YzFHCtmH

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1116
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1200
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1256
          • C:\Users\Admin\AppData\Local\Temp\48b4afdf7858765829821b31438b8038_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\48b4afdf7858765829821b31438b8038_JaffaCakes118.exe"
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of UnmapMainImage
            • Suspicious use of WriteProcessMemory
            PID:1724
            • C:\Users\Admin\AppData\Roaming\Ykyxy\dovu.exe
              "C:\Users\Admin\AppData\Roaming\Ykyxy\dovu.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of UnmapMainImage
              • Suspicious use of WriteProcessMemory
              PID:1620
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp56eb8b29.bat"
              3⤵
              • Deletes itself
              PID:2708
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:304

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmp56eb8b29.bat

            Filesize

            271B

            MD5

            d4fbc002967efdba5dcb3dc313db4336

            SHA1

            89da69cac9a45c8e0360eeaf66a60bc1e193fd64

            SHA256

            15e887b2c0a47631716d2101e7772d174b19e4f150c2b1c32a405f1d38199550

            SHA512

            663fe24188892cf55952810f8817f0ae3306aafd4602ea0b8349983a867e3cef6e2b3b2d018ccaee2b35dc4632d49bd56e840eaebaae176c8a4a60dcb9c872b9

          • C:\Users\Admin\AppData\Roaming\Ocok\ijnyn.aka

            Filesize

            380B

            MD5

            9c4c4a0bbc23ec1428d7300246fb6b48

            SHA1

            ca8f2cd3909c43ae19711fb7f42ce5791b419dba

            SHA256

            4469a5aaef2f2dac35a090731ba36f6d8226f0a2b1f32a3565cb0821f8d50a02

            SHA512

            238d2d04d500bb8110f21a56482724f66067b5fd46048fd474effcc2d08793f7324c981a82e7818e9be74476e9b7839e64fad84d2c99782eae8adf77003b7f48

          • C:\Users\Admin\AppData\Roaming\Ykyxy\dovu.exe

            Filesize

            290KB

            MD5

            cf88d217a0052de75018d5c1580dcc9b

            SHA1

            c07ac8e377fbde07b92baf8f6b645301157033f9

            SHA256

            de6bc2ee5c40cb1fcf463d251639b18e69c258deb5afc1a2a0d1b71f6464b8a9

            SHA512

            36032a15796590d76694a036efba46ea3e0a86ae2cf8ffae967239b2a2a0be1eefa372dd1bb7d325fa45afd8cd2ab9c0fb18db5d452bde14e40adc0d6d00b76b

          • memory/304-42-0x0000000001E80000-0x0000000001EC1000-memory.dmp

            Filesize

            260KB

          • memory/304-43-0x0000000001E80000-0x0000000001EC1000-memory.dmp

            Filesize

            260KB

          • memory/304-41-0x0000000001E80000-0x0000000001EC1000-memory.dmp

            Filesize

            260KB

          • memory/304-40-0x0000000001E80000-0x0000000001EC1000-memory.dmp

            Filesize

            260KB

          • memory/1116-27-0x0000000002280000-0x00000000022C1000-memory.dmp

            Filesize

            260KB

          • memory/1116-23-0x0000000002280000-0x00000000022C1000-memory.dmp

            Filesize

            260KB

          • memory/1116-21-0x0000000002280000-0x00000000022C1000-memory.dmp

            Filesize

            260KB

          • memory/1116-25-0x0000000002280000-0x00000000022C1000-memory.dmp

            Filesize

            260KB

          • memory/1116-19-0x0000000002280000-0x00000000022C1000-memory.dmp

            Filesize

            260KB

          • memory/1200-32-0x0000000000140000-0x0000000000181000-memory.dmp

            Filesize

            260KB

          • memory/1200-30-0x0000000000140000-0x0000000000181000-memory.dmp

            Filesize

            260KB

          • memory/1200-31-0x0000000000140000-0x0000000000181000-memory.dmp

            Filesize

            260KB

          • memory/1200-33-0x0000000000140000-0x0000000000181000-memory.dmp

            Filesize

            260KB

          • memory/1256-38-0x0000000002580000-0x00000000025C1000-memory.dmp

            Filesize

            260KB

          • memory/1256-35-0x0000000002580000-0x00000000025C1000-memory.dmp

            Filesize

            260KB

          • memory/1256-37-0x0000000002580000-0x00000000025C1000-memory.dmp

            Filesize

            260KB

          • memory/1256-36-0x0000000002580000-0x00000000025C1000-memory.dmp

            Filesize

            260KB

          • memory/1620-16-0x00000000002F0000-0x0000000000331000-memory.dmp

            Filesize

            260KB

          • memory/1620-17-0x0000000000370000-0x00000000003BD000-memory.dmp

            Filesize

            308KB

          • memory/1620-18-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/1620-279-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/1724-74-0x00000000775F0000-0x00000000775F1000-memory.dmp

            Filesize

            4KB

          • memory/1724-58-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-2-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/1724-72-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-70-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-68-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-66-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-77-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-160-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/1724-64-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-79-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-62-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-60-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-75-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-56-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-54-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-53-0x00000000004A0000-0x00000000004E1000-memory.dmp

            Filesize

            260KB

          • memory/1724-47-0x00000000004A0000-0x00000000004E1000-memory.dmp

            Filesize

            260KB

          • memory/1724-136-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-81-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/1724-49-0x00000000004A0000-0x00000000004E1000-memory.dmp

            Filesize

            260KB

          • memory/1724-51-0x00000000004A0000-0x00000000004E1000-memory.dmp

            Filesize

            260KB

          • memory/1724-3-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/1724-4-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/1724-45-0x00000000004A0000-0x00000000004E1000-memory.dmp

            Filesize

            260KB

          • memory/1724-5-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/1724-0-0x0000000000270000-0x00000000002B1000-memory.dmp

            Filesize

            260KB

          • memory/1724-1-0x0000000000370000-0x00000000003BD000-memory.dmp

            Filesize

            308KB