Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    13s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 19:35

General

  • Target

    756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe

  • Size

    10KB

  • MD5

    756dbc6a7b99424cb63590daadb3f73a

  • SHA1

    b5fc884b5d1bb5b38cf4bb37ade1e75db5d8f71c

  • SHA256

    93f25c6408d8c1ba344c5cf8b206b0145c6d030c28cd23568dd03e27249c77ca

  • SHA512

    e1b1cbdb2ed04a348e3d51f871a64b3c0b43b4217d959daa52fb58042a9eb27c178d15647f3bfeb27eb61b0623efe3d7fb7f432230e53bef9e582d5c4923ed18

  • SSDEEP

    192:OjfO4JtTSaXqs1T6ka2MwLE1Uclsu1CVbQENQv50wqMT8UQLr0KMaap:OjxJ113vMME1Uclsu1pEgqMT8Un/aY

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\7742.tmp.bat
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7742.tmp.bat

    Filesize

    207B

    MD5

    44ee85f986851abb932ea8d95aaf70e0

    SHA1

    2b85fa2fb15447bf7069c72e55ca2b5c9fec46ac

    SHA256

    82e0ee326ff2464fe10e1eb43e1047f0fd3043541b6fddddde46add5961e94e5

    SHA512

    1468065c3b8a00a87188a18bd1b74feee310d6f5e297496c6cea5d73f16b6802fe308ca9bf6765a628212835560447d7ed80751762569dc16c74a15f1ae8179b

  • C:\Windows\SysWOW64\midimapcb.dll

    Filesize

    1.0MB

    MD5

    73a50d20df250f3a685e0aeb65df6594

    SHA1

    a356bed23bc30da5cef9574ad7632dc03d052918

    SHA256

    0769fce3bb34bdd5ff3cae0c40b05f92f1f7dccbfacc3e3d0aa52f88b5a03b10

    SHA512

    1cd3e63d8a11c0a8b3de7000bdc5430b7af94b38f0e2cd6efdc2d0c2a5d1732fb757528b7e0af61dc05be77ef44f751f59bf45719ac28bed20179b4d5ac5d057