Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 16:57

General

  • Target

    7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe

  • Size

    22KB

  • MD5

    7073938a8e46f5b460c7108bb4d332ba

  • SHA1

    b8aac7cd90a0dd357edeb8a1df7e3b3a85d095b6

  • SHA256

    c8e010b23b7ab3f5b2ad045f688fb8ca71e9d31a7a14570953487bf3aa4811dc

  • SHA512

    89f7265e6d86388e09abe5ec1e4f9efab2f29042e5951d0bd0ecc6b12017fcca6ce86066f123c288081565ae2e7222cab2dddf7f777bac6e37569359c6fe986b

  • SSDEEP

    384:htRDQOeQwzyl5Ut+PltYHPyBLckk/6J34w+o:fRMOgyOu8WE/6J3P

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Windows\SysWOW64\uamovie.exe
      uamovie 28473924734792328473
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\uamovie.exe

    Filesize

    13KB

    MD5

    c99dc4d9f9d97fc294aee1fcff64e337

    SHA1

    b2cf1230cb6db309eec9683005c5d06b6f627ec7

    SHA256

    c8c3c77b57b9b058a6c60b57ffd0d7c960da0edf4a948cba05049309cf02fcee

    SHA512

    bb08ec3ac09e842d7730fb02b37d989b88ead6398377cf5883a9e996329a89f572c43925349ded7a2a56f92f21fd2d30dfe23d56b488594c603025a8099636a9