Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    10/08/2024, 12:17

General

  • Target

    8605a1a556926842a95ab84eda97af74_JaffaCakes118.exe

  • Size

    48KB

  • MD5

    8605a1a556926842a95ab84eda97af74

  • SHA1

    670b9eeac6080b26541ede974941fc7032e13c6d

  • SHA256

    b396e362c1d32d61fb654c2766025fcb8a86bc26776ad1f478ffb43a4bfc8878

  • SHA512

    50b9f2fd804465bcc149174d45c81bdede5a2f7cf98b99cda88b6f1110710acb8a21a01f5f1d7c6e7c4db4e4679a9a2afef6dd2ad52538eee246de49a47f11fb

  • SSDEEP

    768:jVhHmMth6A4Uq6y+KkIP8c5+L/xa7JABVS06lyuoNDCktKXjlyoqpkXf:jzHmMthuUq9+Kk48C+QJAuoNgXjlyo6k

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8605a1a556926842a95ab84eda97af74_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8605a1a556926842a95ab84eda97af74_JaffaCakes118.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2940
    • \??\c:\windows\bill102.exe
      c:\windows\bill102.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:1884
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 612
        3⤵
        • Program crash
        PID:1036
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\dxxdv34567.bat
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\bill102.exe

    Filesize

    48KB

    MD5

    8605a1a556926842a95ab84eda97af74

    SHA1

    670b9eeac6080b26541ede974941fc7032e13c6d

    SHA256

    b396e362c1d32d61fb654c2766025fcb8a86bc26776ad1f478ffb43a4bfc8878

    SHA512

    50b9f2fd804465bcc149174d45c81bdede5a2f7cf98b99cda88b6f1110710acb8a21a01f5f1d7c6e7c4db4e4679a9a2afef6dd2ad52538eee246de49a47f11fb

  • C:\Windows\dxxdv34567.bat

    Filesize

    277B

    MD5

    2b998e585185c414d80ff44353e5dcd9

    SHA1

    7fd5b5a1f84ed00f57644eb87d36076a9721b915

    SHA256

    8a02487d5946c099a34403044253ae5dbebf69313ed33b68bb4e4fb62a7d59e4

    SHA512

    01b75b85753d3a795f7b0485ee009f783093b2c0738030c2bfbe5215fe4934d95d02522cc6329ce64e53255c87e7ffb7308a52425184fd55d181577a8700efba

  • memory/2940-0-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/2940-14-0x0000000000290000-0x00000000002B2000-memory.dmp

    Filesize

    136KB

  • memory/2940-18-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/2940-8-0x0000000000290000-0x00000000002B2000-memory.dmp

    Filesize

    136KB