Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2024, 11:48

General

  • Target

    631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe

  • Size

    2.7MB

  • MD5

    631c9d33ff3a8d714864fd18e1dbf725

  • SHA1

    d56dbf573cb6082eea1f7b4469e8a5f2be6c75be

  • SHA256

    19e60fcde1b38e7fd6274e33a8defc1658677800d4a85a2c788decc600a36e66

  • SHA512

    86be94c10eecf2c76b5b92dec3bd8ed188c4be0a8b2b3078131ee037185ecb58a37aa99c3df2767800c4c1272f9dc8440613dccae5e5d9e21331a1051e8f9ee3

  • SSDEEP

    49152:RAbx0lVw1ug+yPmu1YNTxNMUWHNIFS3v+4X3PMkMNI/JhM:RAbxL1ug+yuu1Yp7MUWHNHqkwI/A

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 12 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2784
      • C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
        3⤵
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 164
          4⤵
          • Program crash
          PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2540-23-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-32-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-33-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-11-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-13-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-16-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-25-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-31-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-18-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-36-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-19-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-35-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-9-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2540-27-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2540-21-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2784-34-0x0000000000400000-0x00000000005C5000-memory.dmp

    Filesize

    1.8MB

  • memory/2784-5-0x0000000000400000-0x00000000005C5000-memory.dmp

    Filesize

    1.8MB

  • memory/2784-3-0x0000000000400000-0x00000000005C5000-memory.dmp

    Filesize

    1.8MB

  • memory/3044-0-0x0000000073FA1000-0x0000000073FA2000-memory.dmp

    Filesize

    4KB

  • memory/3044-1-0x0000000073FA0000-0x000000007454B000-memory.dmp

    Filesize

    5.7MB

  • memory/3044-8-0x0000000073FA0000-0x000000007454B000-memory.dmp

    Filesize

    5.7MB

  • memory/3044-2-0x0000000073FA0000-0x000000007454B000-memory.dmp

    Filesize

    5.7MB