Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    15/07/2024, 12:30

General

  • Target

    49c9983935cc0af7407a6023249ebd35_JaffaCakes118.exe

  • Size

    2KB

  • MD5

    49c9983935cc0af7407a6023249ebd35

  • SHA1

    33154f362544425775e88ac983b11f3ba45c76c4

  • SHA256

    6a6f8029857a2ef3f75c9651ede0b08089212082fc965132baf82d5b85b18cbc

  • SHA512

    459f1cae341eaa77f45b0b456bc5b77a9084a190669f5ecb0fe8f19ccd6aac2a75f434c73b9d10d74161598f02fed376b964b2fbc1fea2f03f51b2a5a84cc9cc

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49c9983935cc0af7407a6023249ebd35_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\49c9983935cc0af7407a6023249ebd35_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\SysWOW64\wservice.exe
      C:\Windows\system32\wservice.exe -s
      2⤵
      • Executes dropped EXE
      PID:1788

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ffservice.exe

    Filesize

    2KB

    MD5

    49c9983935cc0af7407a6023249ebd35

    SHA1

    33154f362544425775e88ac983b11f3ba45c76c4

    SHA256

    6a6f8029857a2ef3f75c9651ede0b08089212082fc965132baf82d5b85b18cbc

    SHA512

    459f1cae341eaa77f45b0b456bc5b77a9084a190669f5ecb0fe8f19ccd6aac2a75f434c73b9d10d74161598f02fed376b964b2fbc1fea2f03f51b2a5a84cc9cc

  • memory/2408-16-0x0000000000400000-0x0000000000404000-memory.dmp

    Filesize

    16KB