Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10/08/2024, 11:38

General

  • Target

    85e75eb6e8da394de9739ae4244f8a1d_JaffaCakes118.exe

  • Size

    50KB

  • MD5

    85e75eb6e8da394de9739ae4244f8a1d

  • SHA1

    f06769bcf485c60e64a8a9d9efa2307add1dbd80

  • SHA256

    59ffd6fb0547f5787bfd20f8e61ae53cd1e8b38dafb784982967d562430c88d3

  • SHA512

    a864d2ae07a8d40667283c1b9ecdce5b20e256ed64b799322b06f9587791fb07ca19f51bf35fba638e23d98363392060a20ea344e1b4341755f454eb4c909ff6

  • SSDEEP

    768:w4PE5eark7aaPFYoIIAyhQ7u1oIVTXHuq4NXsewvVNsqOlWDtDZJWEnRrev:tM5ea47aa9p27u6IZuq4N8g+DLJWCR

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85e75eb6e8da394de9739ae4244f8a1d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\85e75eb6e8da394de9739ae4244f8a1d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\85e75eb6e8da394de9739ae4244f8a1d_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\removalfile.bat

    Filesize

    43B

    MD5

    9a7ef09167a6f4433681b94351509043

    SHA1

    259b1375ed8e84943ca1d42646bb416325c89e12

    SHA256

    d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7

    SHA512

    96b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df

  • \Windows\SysWOW64\qomnkhh.dll

    Filesize

    33KB

    MD5

    58c5fb44de7c4ae593701bac4927f11c

    SHA1

    d958aad1d441ef0de588c7f15bd68c153330b513

    SHA256

    8fe4fe83ec6b12f3aca378258bdc12b69854adfa5323285e78c0ed3d4fdbabed

    SHA512

    7f27b9f0b8a83624c9dc69c4224fc50be240671a1bfa11ba3c3f1ddba45dce3a43beae1f56b0e9ac19a20ca3d63485613b768b63714a35bc0784164ca4788e6a

  • memory/2884-0-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2884-4-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2884-1-0x0000000000401000-0x000000000040E000-memory.dmp

    Filesize

    52KB

  • memory/2884-14-0x0000000010000000-0x0000000010014000-memory.dmp

    Filesize

    80KB