Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    24/07/2024, 01:25

General

  • Target

    69bcf20c8f782ac84180d521a16e84b1_JaffaCakes118.dll

  • Size

    128KB

  • MD5

    69bcf20c8f782ac84180d521a16e84b1

  • SHA1

    0e6e4e0cbde9f21681635b608a5f582a7f19fba5

  • SHA256

    0fe2f1ba1759ad634e0c14bf67841e008dc6bf7e111cd36db571d08c1bb597b5

  • SHA512

    045b1f7d671be625066f358c8cd8d7316a958f4a5e1402fb2ec7ec942bfc4bd4b614eb196d55fc5f4e8e1d3bc173a14054fb4861e47c78ae2dd02fea82aca49c

  • SSDEEP

    1536:+lAp0/ZI5NP6rzTTfAiFyBQRSawH1qr+80bFZDsMvczOw5xHoDkA25ZDKMMiU1al:2prIh6pWsr+xZDsI8akp5hKMMiU1m9

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:420
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1116
      • C:\Windows\system32\Dwm.exe
        "C:\Windows\system32\Dwm.exe"
        1⤵
          PID:1204
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          1⤵
            PID:1252
            • C:\Windows\system32\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\69bcf20c8f782ac84180d521a16e84b1_JaffaCakes118.dll,#1
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1896
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe C:\Users\Admin\AppData\Local\Temp\69bcf20c8f782ac84180d521a16e84b1_JaffaCakes118.dll,#1
                3⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2960
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            1⤵
              PID:932

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1252-3-0x0000000002200000-0x0000000002201000-memory.dmp

              Filesize

              4KB

            • memory/2960-0-0x00000000001B0000-0x00000000001B9000-memory.dmp

              Filesize

              36KB

            • memory/2960-2-0x0000000010000000-0x0000000010023000-memory.dmp

              Filesize

              140KB