Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 05:58

General

  • Target

    72d6a7fc04157865e34d0b1ce59418fd_JaffaCakes118.exe

  • Size

    182KB

  • MD5

    72d6a7fc04157865e34d0b1ce59418fd

  • SHA1

    b81128ff98e03fc03bd0bd583ef4b3d1a5d334ae

  • SHA256

    5aabd5c248a0a2802bf93c5de050306a18cd606bd5ba871752ce299273447c99

  • SHA512

    2ab117b6d49a43d61bfcaa1c9d0259fcac94d0d1494830911a8b8c46aca3a64c5bcf216370887f001b5323c3535135afbf73be65bbf4423f3db1b8fdc9b5d4fa

  • SSDEEP

    3072:XMmidb7kHp3jSIPr8ZSLsousgjMNkYp8jY/+thH:/iZQJzSg8S4+gjpO4Y/qhH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72d6a7fc04157865e34d0b1ce59418fd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\72d6a7fc04157865e34d0b1ce59418fd_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~21A4.bat "C:\Users\Admin\AppData\Local\Temp\72d6a7fc04157865e34d0b1ce59418fd_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Users\Admin\AppData\Local\keygen.exe
        C:\Users\Admin\AppData\Local\keygen.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~21A4.bat

    Filesize

    807B

    MD5

    cd9c38158babb9ba179fb9542b7c5db6

    SHA1

    451329cf3997c947b94faac7ec3d411caed3cd5c

    SHA256

    c192d151dadf3e5f1e8983fec04b0e0336ec890893f86ff27960f833dadd3abc

    SHA512

    d9ef7209af7b0fc9582d8a87d82824966b3564747d0a874d4e49b83eacd0c6d5abdd092b6ac34b48fcf07fb4f048027b63d8fbb097706ed4b86900235c7582f0

  • \Users\Admin\AppData\Local\keygen.exe

    Filesize

    133KB

    MD5

    19168e1dde8e0f15a8cfdaa05c0cdb63

    SHA1

    9d7a9a4de304a19e482795349813568b071ff573

    SHA256

    0045ec5cbadd1d21e44acfae093c117bc92ea436f23126dc88eb0f2f772de3c5

    SHA512

    f229e6a6c509476c7b2ab74c5dcb34ec2046d7e6b0d158a9128e9b2faf05dd486d558cc9adf0627c2177003820b28eb6c819d5aa872b3beba311968d3fd1802b

  • memory/2220-13-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2968-6-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2968-9-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2968-15-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2968-16-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/3024-11-0x0000000000220000-0x0000000000222000-memory.dmp

    Filesize

    8KB

  • memory/3024-10-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/3024-12-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/3024-14-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/3024-19-0x0000000000220000-0x0000000000222000-memory.dmp

    Filesize

    8KB