Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 13:11

General

  • Target

    8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe

  • Size

    57KB

  • MD5

    8a7c7bf658abd83567dae93079efcf56

  • SHA1

    fc4c89d005152ce65a02082b45f5b790f47310a5

  • SHA256

    5274344b4f4b795fd26e838018548507acd13123087131b0d8c2cfdabc0ac8de

  • SHA512

    0fc6270daf10b9f1489f09e6cd0433e174dd20afbf60b31d8819098bdd754bbe744298212e388504f3f2ccdb649f7c32a6b4dc03ef58cd7a3ed06a96dab94fae

  • SSDEEP

    1536:WqBwbLWJLJFKqAZzrZA4kJJ6VplAfEXhL4PEPZxrYYwe:WqBFJLzgOJJ8w0LgEPzrYQ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c copy C:\Users\Admin\AppData\Local\Temp\ife.txt "C:\PROGRA~1\INTERN~1\ieframe.dll" /a
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:2464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ife.txt

    Filesize

    19.5MB

    MD5

    f903b09154f976fa5a1fe98d2335e11f

    SHA1

    4ab8e37d6ceeb4e1410e36d7da8565923f6abcbb

    SHA256

    c86d29b2287a8b548b0d60c25e5185578ef779185a6c8a82fbf06e3f80e14d68

    SHA512

    04169bf78cf3ed1025343c225df7ab0c362e5984299914fb553b9f6207be9ecb4ac60334c2e57a36a26ef667bb0594f76bfb5d5a2ca9feae9d272eccaa3cd4cd

  • \Users\Admin\AppData\Local\Temp\nseF2C9.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    e54eb27fb5048964e8d1ec7a1f72334b

    SHA1

    2b76d7aedafd724de96532b00fbc6c7c370e4609

    SHA256

    ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

    SHA512

    c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

  • \Users\Admin\AppData\Local\Temp\nseF2C9.tmp\time.dll

    Filesize

    10KB

    MD5

    38977533750fe69979b2c2ac801f96e6

    SHA1

    74643c30cda909e649722ed0c7f267903558e92a

    SHA256

    b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35

    SHA512

    e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53