Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 23:30

General

  • Target

    71b1f0eeb64b621ce42b9114245b6568_JaffaCakes118.exe

  • Size

    77KB

  • MD5

    71b1f0eeb64b621ce42b9114245b6568

  • SHA1

    1bff4cf0ad6b16eb3a8470b5e42efc6475ee6cbf

  • SHA256

    0a87fa34fb2315d82731b1ee00e0f2a550b913ee199e8facb29a6120511a628f

  • SHA512

    6d1eeaacc64aa26519d6301be85a39bc0a37f6ab0f083aafa53513e95d3b725bd3658e2e8e8c6b5b98ec0905d1ef610714b34e530f81bfe27f901c2ebc79c677

  • SSDEEP

    1536:h4Cj21eXzXRRLefTjRDfZZTZG8RJPKyaoSoSNdZIpJ0u/Q4/0a:hK1ezItDvdjPKyajokuXdMa

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71b1f0eeb64b621ce42b9114245b6568_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\71b1f0eeb64b621ce42b9114245b6568_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\71b1f0eeb64b621ce42b9114245b6568_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\71b1f0eeb64b621ce42b9114245b6568_JaffaCakes118.exe"
      2⤵
      • Modifies firewall policy service
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2892
      • C:\Users\Public\S-2535-6853-2745\winrsvn.exe
        "C:\Users\Public\S-2535-6853-2745\winrsvn.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\lihgLKdI1d.log

    Filesize

    10KB

    MD5

    8c35f2cce4bbc1433b394b03d63b049f

    SHA1

    5ffb62edcaa630d2cc9d3c186a9e37e23921e8fa

    SHA256

    3b91b98de32c74292d0109ca538a46a7d7093f8d88076a686fcecd93f3f124d0

    SHA512

    ad6bc2331101bffa26676540afbeec4bb803e2ebb11af76ccf43b940d62fe4c9317179e51d57c64bd56ba21be9f8512d3b98092766c522f7e4a0ca091feb0315

  • \Users\Public\S-2535-6853-2745\winrsvn.exe

    Filesize

    77KB

    MD5

    71b1f0eeb64b621ce42b9114245b6568

    SHA1

    1bff4cf0ad6b16eb3a8470b5e42efc6475ee6cbf

    SHA256

    0a87fa34fb2315d82731b1ee00e0f2a550b913ee199e8facb29a6120511a628f

    SHA512

    6d1eeaacc64aa26519d6301be85a39bc0a37f6ab0f083aafa53513e95d3b725bd3658e2e8e8c6b5b98ec0905d1ef610714b34e530f81bfe27f901c2ebc79c677

  • memory/2360-37-0x0000000002680000-0x0000000002780000-memory.dmp

    Filesize

    1024KB

  • memory/2360-13-0x0000000000330000-0x0000000000340000-memory.dmp

    Filesize

    64KB

  • memory/2360-12-0x0000000000330000-0x0000000000340000-memory.dmp

    Filesize

    64KB

  • memory/2360-58-0x0000000002680000-0x0000000002780000-memory.dmp

    Filesize

    1024KB

  • memory/2360-40-0x0000000002680000-0x0000000002780000-memory.dmp

    Filesize

    1024KB

  • memory/2360-32-0x0000000002680000-0x0000000002780000-memory.dmp

    Filesize

    1024KB

  • memory/2360-39-0x0000000000330000-0x0000000000340000-memory.dmp

    Filesize

    64KB

  • memory/2892-38-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2892-22-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2892-20-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2892-26-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2892-33-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2892-41-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2892-24-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2892-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB