Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    15/07/2024, 07:53

General

  • Target

    48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe

  • Size

    61KB

  • MD5

    48e20220d52a21d9b5587f20e5ea2922

  • SHA1

    3599132f5102a199e872abaa917a3f0986dcb846

  • SHA256

    4b992fd80ee8dd12549462c198b14a874fdedf35395cf1eaa29982e86de115a0

  • SHA512

    fe5dd4c1df21429d446576f8f8659a12d998c3ee8afb43a4ab43f3413e98c706efe008ef1ad4fd2891e557be1c4a6f56fa7cc8c636dbbe5c2999446573fcf8a4

  • SSDEEP

    1536:1OPhlosUoAarDX1JJvZg+BwXUp74XW+x+G:1OPlfJJe+WA2zx+G

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 3 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Windows\SysWOW64\wscript.exe
      wscript.exe /nologo "C:\Users\Admin\AppData\Local\Temp\6622.nfo"
      2⤵
        PID:2804

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nsd9C41.tmp\InetLoad.dll

      Filesize

      18KB

      MD5

      994669c5737b25c26642c94180e92fa2

      SHA1

      d8a1836914a446b0e06881ce1be8631554adafde

      SHA256

      bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c

      SHA512

      d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563

    • \Users\Admin\AppData\Local\Temp\nsd9C41.tmp\nsRandom.dll

      Filesize

      21KB

      MD5

      ab467b8dfaa660a0f0e5b26e28af5735

      SHA1

      596abd2c31eaff3479edf2069db1c155b59ce74d

      SHA256

      db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

      SHA512

      7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

    • memory/2120-5-0x00000000003D0000-0x00000000003E2000-memory.dmp

      Filesize

      72KB

    • memory/2120-20-0x00000000003D0000-0x00000000003D2000-memory.dmp

      Filesize

      8KB