Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10/08/2024, 20:37 UTC

General

  • Target

    87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe

  • Size

    97KB

  • MD5

    87965f52e2fcfe21be4ea64567dd404b

  • SHA1

    3ea30d86c1c9c81c664b0f2cd86dd08a5e591eaa

  • SHA256

    cf2d0db0a6ba715e8a536cc68c01b1e2422edfbbbf8d9f1dc8d19fde6bf21c25

  • SHA512

    f2458526907617ed19111f3139f6bbdd46c714ef0d27d44a3a3ba19a3431dcc363efaf1eac9cc23bf8fb34331c94f44937af3949830374e97dbf547fcdca31fb

  • SSDEEP

    1536:UoXDGQ4XBc8d4xsvi0ut3oTUOQIrw1zybzIKJMDNDYU/YRF2VmQhw57Zg06:9XDGQ4RcOzvQNnV1zQYNfHhNV

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Users\Admin\AppData\Local\Temp\87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1796

Network

  • flag-us
    DNS
    imagesrepository.com
    87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    imagesrepository.com
    IN A
    Response
  • flag-us
    DNS
    protection-manager.com
    87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    protection-manager.com
    IN A
    Response
  • flag-us
    DNS
    zone-searching.com
    87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    zone-searching.com
    IN A
    Response
  • flag-us
    DNS
    images-base.com
    87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    images-base.com
    IN A
    Response
  • flag-us
    DNS
    protect-management.com
    87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    protect-management.com
    IN A
    Response
No results found
  • 8.8.8.8:53
    imagesrepository.com
    dns
    87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe
    66 B
    144 B
    1
    1

    DNS Request

    imagesrepository.com

  • 8.8.8.8:53
    protection-manager.com
    dns
    87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe
    68 B
    141 B
    1
    1

    DNS Request

    protection-manager.com

  • 8.8.8.8:53
    zone-searching.com
    dns
    87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe
    64 B
    137 B
    1
    1

    DNS Request

    zone-searching.com

  • 8.8.8.8:53
    images-base.com
    dns
    87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe
    61 B
    134 B
    1
    1

    DNS Request

    images-base.com

  • 8.8.8.8:53
    protect-management.com
    dns
    87965f52e2fcfe21be4ea64567dd404b_JaffaCakes118.exe
    68 B
    141 B
    1
    1

    DNS Request

    protect-management.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1756-0-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/1756-10950-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/1796-1-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/1796-10948-0x0000000000720000-0x0000000000721000-memory.dmp

    Filesize

    4KB

  • memory/1796-10951-0x0000000000720000-0x0000000000721000-memory.dmp

    Filesize

    4KB

  • memory/1796-10952-0x000000007285A000-0x000000007285B000-memory.dmp

    Filesize

    4KB

  • memory/1796-10953-0x00000000727E0000-0x0000000073842000-memory.dmp

    Filesize

    16.4MB

  • memory/1796-10954-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/1796-10955-0x0000000000720000-0x0000000000721000-memory.dmp

    Filesize

    4KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.