Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

3

8ae9119ab5...18.exe

windows7-x64

8ae9119ab5...18.exe

windows10-2004-x64

Analysis

  • max time kernel
    6s
  • max time network
    8s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 15:29

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    8ae9119ab53d72ad8a1efc929ba94dde_JaffaCakes118.exe

  • Size

    322KB

  • MD5

    8ae9119ab53d72ad8a1efc929ba94dde

  • SHA1

    2f6c2f75938bb9bd419716eb62738d5de920db2e

  • SHA256

    7f4b582a90ab91a1072fc986b845d7ba2b163394088033c40717d91dd44f1dcc

  • SHA512

    c8d5c9db6b1e3689c6f80764f20ecb09e70a10f5d29474db85dcbffb58a4e1a60fece6d1aa8cd7a2c17bf79b4133834319ead81b8af2b59d220e73a15ee05601

  • SSDEEP

    6144:T7Tv/GxheOYjgmiZQ7UInWhYg2rgNY14AYdJkfrcF4uSX7eSBe:/2heOsgmiknfDrv14RdQ9bp

Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ae9119ab53d72ad8a1efc929ba94dde_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8ae9119ab53d72ad8a1efc929ba94dde_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2812
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Windows\system32\delete.bat""
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2644
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2820
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:300

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\delete.bat
        Filesize

        220B

        MD5

        bee3116a95bcae62f226b01f0f03ce80

        SHA1

        95ce1fb95312c5dc1360bf36dfa54d9d678a80a4

        SHA256

        c163fb4735c902ce2c88a3af1ba2351c580ef3c92e2b1addace1c34dfe5dd741

        SHA512

        f102cc6d24c51f4938469d4eaaaf5d6f9b840bf6ba2fa1b4a25ace406c34d337184853c9b6960ef25ffb60197f66b353b09f1867800888a17926e9e8b3f63509

        Download Submit

      • memory/300-14-0x0000000002B30000-0x0000000002B31000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2812-0-0x00000000740D1000-0x00000000740D2000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2812-1-0x00000000740D0000-0x000000007467B000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2812-2-0x00000000740D0000-0x000000007467B000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2812-12-0x00000000740D0000-0x000000007467B000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2820-13-0x0000000002F10000-0x0000000002F11000-memory.dmp

        Filesize

        4KB

        Download