Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19/07/2024, 05:08

General

  • Target

    5a967ca8b80f5068195d9e53a8918cd2_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    5a967ca8b80f5068195d9e53a8918cd2

  • SHA1

    d0ee78a1b32d7888e2ddc6a558d28fcde614535a

  • SHA256

    5875ccbe6a71fc56252109e970c41a95ca89cb7e44cc9d3157d0435dd34a1256

  • SHA512

    33f54feb458e84e5c3ba2dbfa7f5efef2396102c9c09bdc821aa232aececfde31cf13beb47e0e34749c8f86d616acad248c8e15987382a28b8d33aa9cc4397d6

  • SSDEEP

    24576:a2b5g3C3ayZVaT5vnHILbzNZI5fEoX1nsaO3KrkWV253Bs04e4QLdyqow93:nfVaNgLfNZIFF1saSCk59KDpmdL

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a967ca8b80f5068195d9e53a8918cd2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5a967ca8b80f5068195d9e53a8918cd2_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1864

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\E_N4\HtmlView.fne

    Filesize

    212KB

    MD5

    4c9e8f81bf741a61915d0d4fc49d595e

    SHA1

    d033008b3a0e5d3fc8876e0423ee5509ecb3897c

    SHA256

    951d725f4a12cd4ff713ca147fa3be08a02367db6731283c3f1ba30445990129

    SHA512

    cf2c6f8f471c8a5aad563bc257035515860689b73ce343599c7713de8bc8338a031a722f366e005bc1907d6fc97b68b8b415e8ff05b7324fb1040c5dc02315d7

  • \Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

    Filesize

    1.1MB

    MD5

    cf46bb62a1ba559ceb0fad7a5d642f28

    SHA1

    80b63dd193e84bfacbe535587dd38471b8ea2c24

    SHA256

    fe4bba1a99b332c8bbd196d3a2f3c78d9edc8f212842ff2efef17eba38427f67

    SHA512

    1f71f31fdc1ef7695d7a6e79218a9192804178bb2af80486de4f8ff3d7e176860813a61fa265bf78fe4ff722a85b72798938d715d8a2a034ac759505197a1058

  • memory/1864-9-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1864-8-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1864-3-0x0000000000290000-0x00000000002A9000-memory.dmp

    Filesize

    100KB

  • memory/1864-2-0x0000000000220000-0x000000000026B000-memory.dmp

    Filesize

    300KB

  • memory/1864-7-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1864-6-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1864-1-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1864-4-0x00000000002B0000-0x00000000002B9000-memory.dmp

    Filesize

    36KB

  • memory/1864-13-0x0000000000401000-0x0000000000406000-memory.dmp

    Filesize

    20KB

  • memory/1864-5-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1864-16-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1864-18-0x0000000002120000-0x0000000002158000-memory.dmp

    Filesize

    224KB

  • memory/1864-0-0x0000000000220000-0x000000000026B000-memory.dmp

    Filesize

    300KB

  • memory/1864-50-0x0000000000220000-0x000000000026B000-memory.dmp

    Filesize

    300KB