Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2024, 21:07

General

  • Target

    64cf65855ec815d01a69cfec4250be08_JaffaCakes118.exe

  • Size

    948KB

  • MD5

    64cf65855ec815d01a69cfec4250be08

  • SHA1

    e4b0bade0b7a2007ad3bb46079b3bb151ae54c2b

  • SHA256

    25a9637459705bd4671b5052295633331acf30d880d47028f9748ff0ca11e0e8

  • SHA512

    7132baafb5973eadfb71221b52924ca7f72644d4f83e7bfd422c241c7dcb2914bc70540eefa88244c8551fafeeaa0de06b338ea1d7cf5c6f9134e05b1784792d

  • SSDEEP

    24576:BguFhCwUuqDluBMfEhJX3z5mKhwbLe8asm:bhxqDosEL3F/w+B

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\64cf65855ec815d01a69cfec4250be08_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\64cf65855ec815d01a69cfec4250be08_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\smes\u.bat"
      2⤵
        PID:2284
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat"
        2⤵
          PID:2092

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\smes\u.bat

        Filesize

        44B

        MD5

        704efba1aee1454561da552dda430498

        SHA1

        d20fb96683f769eb9cef1b0a068bcba70aeab9c2

        SHA256

        80b08d35bd27636e0774ce35ab57306f76edc6a0f7058cb1f93733cdf88bf94c

        SHA512

        7e0c9ede686238703af4893af8842c05c48ab1681ae273b32d8085cf1a17aae946c0c823a0a418787522a551d684367259ff8203ebca6e4ec69b6ded95231bd0

      • C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat

        Filesize

        135B

        MD5

        e9f0132859b32abec4a1a8b3996eb961

        SHA1

        e1e0dfd3d27dd5db185e4f6e058caa8d443410f8

        SHA256

        83b5e17db2aacd9d833929bfc86d719b5bfee7a33d9e4989b93b99e1af0d2d09

        SHA512

        8b72dceacc20afb48a2bb3e8f78affa22a708f7acb33d2f4ec1955b532e6c77d187e8664ddf7172cb4d50774834cbafa6f48d3036b974b7bede3ac2935161438

      • \Users\Admin\AppData\Local\Temp\nsjAEF6.tmp\AccessControl.dll

        Filesize

        10KB

        MD5

        055f4f9260e07fc83f71877cbb7f4fad

        SHA1

        a245131af1a182de99bd74af9ff1fab17977a72f

        SHA256

        4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc

        SHA512

        a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26

      • \Users\Admin\AppData\Local\Temp\nsjAEF6.tmp\FindProcDLL.dll

        Filesize

        3KB

        MD5

        8614c450637267afacad1645e23ba24a

        SHA1

        e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

        SHA256

        0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

        SHA512

        af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

      • memory/2384-5-0x0000000010000000-0x0000000010003000-memory.dmp

        Filesize

        12KB