Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

8c1c151afa...18.exe

windows7-x64

7

8c1c151afa...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 21:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8c1c151afa61de888de5954a5d6c0a06_JaffaCakes118.exe

  • Size

    152KB

  • MD5

    8c1c151afa61de888de5954a5d6c0a06

  • SHA1

    e4402911da92d8f5288066a3e4b1b1cb50efb180

  • SHA256

    592860e784ff96d9530ebd3ae455f5605bb6b819d5636cca43ccd9a1cf02eeaf

  • SHA512

    d1e4b6545040f72d11413f359f15108978268718c80ff4b500fac7e91517000e7afe2d4fa90d984d18866eb11e3c21406dac48ccb6c19e694477312e4d102ba8

  • SSDEEP

    3072:mZ7LJdATD5BqMdcj/7kdQMgLPYUgw3xpAXJEz33YNx:mZ7dd2VBqXnkK3LAUgw3MuYH

Score
7/10
discovery

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c1c151afa61de888de5954a5d6c0a06_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8c1c151afa61de888de5954a5d6c0a06_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2752
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k imgsvc
    1⤵
    • Deletes itself
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:748

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\fucktray2875600.dll
    Filesize

    112KB

    MD5

    79dd66ade2b79e99e4413911da706ba7

    SHA1

    9a9305a84358ff4e08364e1698817b6b8cdf7862

    SHA256

    cef0b92ecd5de2b7898796b68c15fcd15116591e480b74129f6161f5e3016d21

    SHA512

    06d18adae70fae76b13adf2b7cb791cedd3f5e57caf7d9d0dedff81b1ec847cc0f9857354f5bc8da175be97d79c787036532c72842f1c08aca91e44d9419cbe7

    Download Submit

  • \??\c:\NT_Path.old
    Filesize

    124B

    MD5

    6f0650c6272209a26a55b4112191dc82

    SHA1

    ecdb1aa1a96b9d220028d07b61bfccc11dc772a9

    SHA256

    e07014ca35c6804dceb2159e4508c91c7c7f009ec0b347aaba17ae0fde55801d

    SHA512

    f399e17df6ead816b1d2b33e0f977c994663eccc3416a77dc19877c9cff39a73bae43a4451c72d504ad5c962c2efdfa2d6bb7d988306af235177ddc4ee4b2ea7

    Download Submit

  • \??\c:\program files (x86)\iypt\vuwplkago.pic
    Filesize

    15.5MB

    MD5

    0eea1735be782b09eae7ec580b1999e4

    SHA1

    4b03718d2d3bb6d92b9da1694190514cc087c8a0

    SHA256

    946d11de1a871a772f2f02098368a560c2fabc6d0f756a80c0fbe0b8a5710458

    SHA512

    85bc5a8a2663e89d357b71495b4a325761cd791eeaab033b34039d467cfa4922bb3172d57268cb7e8f02e3c6fc49880a0792f4f18f048dfe76027f45ab588247

    Download Submit