Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27/07/2024, 00:46

General

  • Target

    766bfe7fbcb57bbdb2667888954ef3a5_JaffaCakes118.exe

  • Size

    124KB

  • MD5

    766bfe7fbcb57bbdb2667888954ef3a5

  • SHA1

    4e165ab9fc1f70b57ae235221b9d7c1f775a906a

  • SHA256

    f6f944b37246617aaa6d9e54f1b9ab366e6f67b011f520e5063093fe420a16d8

  • SHA512

    b65fdd225200c288cf8661b6369206e4c2e4405be41c488128577052decb473e5f0746f100fef51e2ceafd39760020d390b361215c8eb9f2d6921c3066244070

  • SSDEEP

    1536:wMtkjaTQ47U0GgAJa0P1kNmKldCMhdu8KWP/nTn8nBP9VeRPNeG0h/y:fkjJeU0GgAT9QIq

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\766bfe7fbcb57bbdb2667888954ef3a5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\766bfe7fbcb57bbdb2667888954ef3a5_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:916
    • C:\Users\Admin\cuvuk.exe
      "C:\Users\Admin\cuvuk.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\cuvuk.exe

    Filesize

    124KB

    MD5

    c87dc17630d20976b5814204cd7ffe60

    SHA1

    198a04ee0db435b3803fe14a0f04ece0d1323b4b

    SHA256

    01a661b9273942e44c01d0371444e95d4765825952687dae9fed85adfb4c83e8

    SHA512

    ec043ef6be285e4860be2220f402b52820f999d2425d70221219177c9d40a3d878aa154fe340fb35e3924469f380e1adb090819ae11e4f578c28468b59599c6f