Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    24/07/2024, 02:47

General

  • Target

    69f8f4fb08d8b3f1a6863fc6c375a0ab_JaffaCakes118.exe

  • Size

    596KB

  • MD5

    69f8f4fb08d8b3f1a6863fc6c375a0ab

  • SHA1

    46219a27afa6b48e6f31d6e53bb2d086d0726262

  • SHA256

    afa9993c1fb9ad29f31d5026aff405c096a54d36f9215cafa87e19a83c11963d

  • SHA512

    8a8f0c9591833d176907142e082fff602afdcf62e44b19af89ebb9e298b786b5ced04e1935fbe9f545450da91ab46aed987d83c7c080c1b4405f186f68364eff

  • SSDEEP

    12288:ZI3ofo9cMmv9AdIflUVhgoaqKAq6xGJOpqW0iMThqJGuutvaWV:ZI16MKAdGiYh0GkpPne5vaWV

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69f8f4fb08d8b3f1a6863fc6c375a0ab_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\69f8f4fb08d8b3f1a6863fc6c375a0ab_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\61642520.BAT
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2832
  • C:\Windows\360stay.exe
    C:\Windows\360stay.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\windows\SysWOW64\svchost.exe
      C:\windows\system32\svchost.exe
      2⤵
        PID:2736

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\360stay.exe

      Filesize

      596KB

      MD5

      69f8f4fb08d8b3f1a6863fc6c375a0ab

      SHA1

      46219a27afa6b48e6f31d6e53bb2d086d0726262

      SHA256

      afa9993c1fb9ad29f31d5026aff405c096a54d36f9215cafa87e19a83c11963d

      SHA512

      8a8f0c9591833d176907142e082fff602afdcf62e44b19af89ebb9e298b786b5ced04e1935fbe9f545450da91ab46aed987d83c7c080c1b4405f186f68364eff

    • C:\Windows\61642520.BAT

      Filesize

      218B

      MD5

      07112b839b9795b8b9a9c375dc8b5f94

      SHA1

      7e1fae193c7fa721dddb97ccdb795e053538ba55

      SHA256

      ad32ca18cc692d97a7f7e0e766863e3f54bf8250afb4bf84079f50ce7c9223a8

      SHA512

      add2a78f0f6d5e0d547136884995e2bff0a3ba438ad3419f9ff28e90365f01538086854892153c4c93f8020c48c7ec2b6fdf3e493eb7543ee882799cbc976f9e

    • memory/1924-36-0x0000000000400000-0x0000000000512000-memory.dmp

      Filesize

      1.1MB

    • memory/1924-19-0x0000000000400000-0x0000000000512000-memory.dmp

      Filesize

      1.1MB

    • memory/2148-14-0x0000000003170000-0x0000000003171000-memory.dmp

      Filesize

      4KB

    • memory/2148-2-0x0000000000660000-0x0000000000661000-memory.dmp

      Filesize

      4KB

    • memory/2148-0-0x0000000000400000-0x0000000000512000-memory.dmp

      Filesize

      1.1MB

    • memory/2148-17-0x0000000003140000-0x0000000003141000-memory.dmp

      Filesize

      4KB

    • memory/2148-16-0x0000000000200000-0x0000000000201000-memory.dmp

      Filesize

      4KB

    • memory/2148-15-0x00000000001F0000-0x00000000001F1000-memory.dmp

      Filesize

      4KB

    • memory/2148-7-0x0000000000640000-0x0000000000641000-memory.dmp

      Filesize

      4KB

    • memory/2148-6-0x00000000006C0000-0x00000000006C1000-memory.dmp

      Filesize

      4KB

    • memory/2148-5-0x0000000002020000-0x0000000002021000-memory.dmp

      Filesize

      4KB

    • memory/2148-4-0x00000000006E0000-0x00000000006E1000-memory.dmp

      Filesize

      4KB

    • memory/2148-3-0x0000000002010000-0x0000000002011000-memory.dmp

      Filesize

      4KB

    • memory/2148-8-0x0000000003130000-0x0000000003131000-memory.dmp

      Filesize

      4KB

    • memory/2148-9-0x0000000003120000-0x0000000003123000-memory.dmp

      Filesize

      12KB

    • memory/2148-10-0x0000000003220000-0x0000000003320000-memory.dmp

      Filesize

      1024KB

    • memory/2148-11-0x0000000003220000-0x0000000003320000-memory.dmp

      Filesize

      1024KB

    • memory/2148-1-0x0000000000590000-0x00000000005EA000-memory.dmp

      Filesize

      360KB

    • memory/2148-33-0x0000000000400000-0x0000000000512000-memory.dmp

      Filesize

      1.1MB

    • memory/2148-34-0x0000000000590000-0x00000000005EA000-memory.dmp

      Filesize

      360KB

    • memory/2736-32-0x0000000000400000-0x0000000000512000-memory.dmp

      Filesize

      1.1MB

    • memory/2736-30-0x0000000000400000-0x0000000000512000-memory.dmp

      Filesize

      1.1MB

    • memory/2736-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB