Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 13:57

General

  • Target

    6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe

  • Size

    60KB

  • MD5

    6fdc949f9df9b1f96b6becb5028c3065

  • SHA1

    4868e9c88788f489dfec0ba7cc035141bdbb94fc

  • SHA256

    cdb5727eaec08f98f3eae94cc3df88b92bb97d2079a44466b61cd4d632d6172a

  • SHA512

    3b84c4f470e3693192493e1b336f12e4d5d959236bbf5b61972b2d312031f367db4e6e541bd06db95f7102136afd36183c66e90322e7208682e8745986aab80c

  • SSDEEP

    1536:Ux8XWoln1KWVwIKCCFDeKaJstZHlyZu3OdeVAl6Is:Uxgl0rOCpHaJaZHlv3OqENs

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 24 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Windows\SysWOW64\regedit.exe
      regedit /s C:\1.reg
      2⤵
      • System Location Discovery: System Language Discovery
      • Runs .reg file with regedit
      PID:2744
    • C:\Windows\SysWOW64\regedit.exe
      regedit /s C:\2.reg
      2⤵
      • System Location Discovery: System Language Discovery
      • Runs .reg file with regedit
      PID:2756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 328
      2⤵
      • Program crash
      PID:2972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\1.reg

    Filesize

    312B

    MD5

    e532a7a5500ac88686f2652774d20cad

    SHA1

    c66cf1e777652669db90e7b41edc789b91f9bc6f

    SHA256

    2cbcd42cde6691a33857e2511ec64daffa3896a1260bcdae088d7b4a34c45bbd

    SHA512

    60b6f0d4b7f1a4ce082855258f97939bbaec4e52f0340e2b10ca587ebf6715b5402cb37f160b8a98734875fc3a7fb2f51148a39e047daa01deb47f5539fdcd07

  • C:\2.reg

    Filesize

    670B

    MD5

    fe7497d77714bc0841d55d07da45d12d

    SHA1

    b45ca6abe83f887248e61df81b8f8dfe49ba146d

    SHA256

    c1178ead6d2aba64f24ba246b6aeeacd366101a91ec706a1563144050c9e6f77

    SHA512

    9d59076bd0cfd483e6d973c43df95efb8a9bd0d7e58a7ab18b75df7bd1c2aaf85b9bff45b60d151420c2716314d81178333ed33b7400c38e22141e91d18e6e6c

  • memory/2372-0-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2372-6-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB