Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 12:45

General

  • Target

    741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe

  • Size

    208KB

  • MD5

    741c4a946960cc072619ad57386f86d7

  • SHA1

    edf31d72b79f9ce512e768c83cb3fd15f8933326

  • SHA256

    9f5a3f423d4d791000b01a625198519c6bebb33e842eb1be0e6f3c46fa59e454

  • SHA512

    b11213c2a16aa02974399b9b89dc806076e5c1fcd0b9c0e03429592f30f714854ced02f3be21a46d301af6441c43918a49bfdaa56114013a12825e1d3c36e908

  • SSDEEP

    1536:/NSXbc74YTOnlNSUL09atT0mBBA7aKSvIYFwAfdvoWQO57:/Eo75OnPSI09qgmBBAGKSvwovoW9B

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Program Files (x86)\44b3adc4\jusched.exe
      "C:\Program Files (x86)\44b3adc4\jusched.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\44b3adc4\44b3adc4

    Filesize

    17B

    MD5

    3330ebaaa7e9f4630f4ad4c156be59d8

    SHA1

    40375cf8e68671e0100e725de5cd5c6657b9f722

    SHA256

    2c8451d5dca9e68ec3af7f318c5d874fbdfea9e89e7b5f9922b4dbd65f027e15

    SHA512

    b7631f9685bac9f81aa6bf53afd839910773e108989bbb79ba39cafabbe6b6994ed2fde44911c9f7f24b45c9745d6e80cd9f01975bfb765561df4881f7dad696

  • \Program Files (x86)\44b3adc4\jusched.exe

    Filesize

    208KB

    MD5

    5f7b48845db460b31a76c01c583ba698

    SHA1

    24f77109fd1bf5893e05e3db4b6035a0ade4876a

    SHA256

    cfe880a6a221b65539150f3e61820dbff4b841f6beaaa61f7e85d77642ca9cd7

    SHA512

    513e090e0822c025ce892b2836ecff44b89e4ea9f899dc452a07361b2fa16907d3d7724f221d6b507613b33f2eea41f66c16272ba157295d2be65731c2958a59

  • memory/2196-15-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2196-17-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2688-0-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2688-14-0x0000000002760000-0x00000000027AE000-memory.dmp

    Filesize

    312KB

  • memory/2688-12-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2688-11-0x0000000002760000-0x00000000027AE000-memory.dmp

    Filesize

    312KB

  • memory/2688-16-0x0000000002760000-0x00000000027AE000-memory.dmp

    Filesize

    312KB