Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    20s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2024, 16:07

General

  • Target

    6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe

  • Size

    784KB

  • MD5

    6842bbf2dc32dea2213de2dbf03f0e44

  • SHA1

    e981d2935f0b20f9078b986ca03f3f0e9df8ac60

  • SHA256

    de4c8fe30c4fc904f2b7f50ccf7092783e6056453eb43b2f905c9b5b50062e42

  • SHA512

    0b9c9c47ee4a5a6b028a0e6609103e0fe47e6c6b8f627613a2c88795b675bc08a47cb53f8b42c15f3ba867bd851ec5a46b8eb13f2853356e6c50e056d5a377b6

  • SSDEEP

    12288:HnEyrrDlSpkXeoh9skBAzIY83fRgQaqNjm1bFHq6qBS8N:/DoGpsSaIH3fNLNCFHDqcI

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 8 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Users\Admin\AppData\Local\Temp\6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of UnmapMainImage
      PID:2368

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe

    Filesize

    784KB

    MD5

    9c58a1f75b000078ab67e8f4905820ca

    SHA1

    f5c063bde49a416fd423c11950997e175a019a3a

    SHA256

    f426fcdb05f15691194ac549262fdf2693f3ab0b5b8dada0bf673d2cb7845583

    SHA512

    20f7327b9fcd633826aa8500704c4e49d4d2a524b34ef1189cac0d2113aab707f4ce9a55937844ca524afb98381bb3e7bd9fb630a428c97c9dce1a1ff2c7dedd

  • memory/2368-18-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2368-34-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/2368-33-0x0000000002FD0000-0x0000000003163000-memory.dmp

    Filesize

    1.6MB

  • memory/2368-32-0x00000000005A0000-0x000000000071F000-memory.dmp

    Filesize

    1.5MB

  • memory/2368-22-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/2368-31-0x0000000000310000-0x00000000003D4000-memory.dmp

    Filesize

    784KB

  • memory/2488-6-0x0000000000120000-0x00000000001E4000-memory.dmp

    Filesize

    784KB

  • memory/2488-1-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2488-14-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2488-16-0x0000000003250000-0x0000000003562000-memory.dmp

    Filesize

    3.1MB

  • memory/2488-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/2488-35-0x0000000003250000-0x0000000003562000-memory.dmp

    Filesize

    3.1MB