Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    42s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 23:31

General

  • Target

    8c6c1b198d895aacf4ccea121fbde47c_JaffaCakes118.exe

  • Size

    191KB

  • MD5

    8c6c1b198d895aacf4ccea121fbde47c

  • SHA1

    0e6c1ba1f7dd454c509dca64bc2f43365f0b23fd

  • SHA256

    7250737c9c7a2c0bf8e838271e34e4b0f7f17ef8ac871cd32ccdb3e17ed0120f

  • SHA512

    b545d0ada76bd29904502b53d2ad20b1efe08cc0925232e7b8b7304d7906bef6e6791e368242dbc7398a8a0f33b449120e9ca0c1e54a2e5e7baa314238219db4

  • SSDEEP

    3072:p5esEn3NM0iAseO13gbnXp4HN2uY3EeWpzGZvlnSwFoCDvbO/4opwu:zCq0SepXpoN2uY3Ee8zalHFNDTOAa

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c6c1b198d895aacf4ccea121fbde47c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8c6c1b198d895aacf4ccea121fbde47c_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Users\Admin\AppData\Local\dplaysvr.exe
      "C:\Users\Admin\AppData\Local\dplaysvr.exe" C:\Users\Admin\AppData\Local\Temp\8c6c1b198d895aacf4ccea121fbde47c_JaffaCakes118.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of UnmapMainImage
      PID:2856
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\F0E4.tmp

    Filesize

    81KB

    MD5

    5569f25dfd9fda8b503a3bd9e16ddd47

    SHA1

    f8185aa05a1f24daefe97cf7593db45a69539489

    SHA256

    0e3bcf6d2e646b3025c6c8d7c70d4b36c0534076af1554b05b682460cd6c5955

    SHA512

    b07b6674c160947e253fedc2e7b3c07d97d545acbf043980771ba941f786e5f7f283f6a9f3d92b42b8aca3ecf7c8f21763ff2d21143829117581bc74fda796b1

  • C:\Users\Admin\AppData\Local\dplayx.dll

    Filesize

    52KB

    MD5

    d99c8c5e66f0e9407591b0dc386d80c0

    SHA1

    67070c06a317ab0686e0080317b59f20a58e6403

    SHA256

    2dfaeabd8cff4d556e481308d200e0b2a683b7bbc89ac8a5ab4d10fe0a08fbb5

    SHA512

    b7e54e9ca534076d235c42b2b3e4595260a8e1263e0188e449f73d594ec72108dbb16fde8fc98e7a4f530f1f541af03bce1e57f12392a0a3a3cd0ed0522cf0e0

  • C:\Windows\System32\drivers\etc\hosts

    Filesize

    884B

    MD5

    53c2b14b258594b29d3d8aa172e93e66

    SHA1

    bec86a56ce8280abfb196a725db751c3be36c554

    SHA256

    2c7c7f676a02b7b09b66e3be5c99e22b59f14955c5eaa0c12ba3b4d80d527015

    SHA512

    2ecf62675d5c74d681010beb65a55555266ad067dde01ae57ec3db0d551df9d8160c50d2b6f9a6a0f44a7bea9ed6744dc95e69ebadfb4b35f46191ef1cfabaa7

  • memory/1200-4-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/1200-3-0x0000000000250000-0x0000000000284000-memory.dmp

    Filesize

    208KB

  • memory/1200-25-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/1200-26-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/2856-23-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2856-22-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2856-24-0x00000000002C0000-0x00000000002D2000-memory.dmp

    Filesize

    72KB