Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 16:45

General

  • Target

    8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe

  • Size

    20KB

  • MD5

    8b26101dcd4ca89e3221f1fddd27c5a3

  • SHA1

    f215ce5cde9eb0f4566f2bafa7c5dc5813f8b13d

  • SHA256

    f11143a9ec5060136d0f3dde69e0de94a1b013e6cb6790bdddea75898b3bfed3

  • SHA512

    adf11d576980982cd1f71d115a2036d559d8667d65e4509e105f35a568f1d9ecdaf35245b5dc3458a67567378aadd3be1ac0bef048bf6aed8bec8545f640f520

  • SSDEEP

    384:sjHpLawENkMcT3dblG3ijwJk70V8OEdojDJb640meMFeWvwWd:6LaTNkJT3dbIyjwJk70V8dUY4qIv

Malware Config

Signatures

  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe"
    1⤵
    • Server Software Component: Terminal Services DLL
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\259443843.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2784
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\259443843.bat

    Filesize

    269B

    MD5

    ffe3a2c055c29352283858d2b1335b84

    SHA1

    2a7dd398172e6e84c0f4c9adc800a31b70cac71e

    SHA256

    1e329bdc986f1b26d50dae66e9c20468429c8ab94d9e5664229fb253ce911c83

    SHA512

    7bf9c5bcc28a3c8661e3d3d0c62e265419d305b732edc917af8ef9cfcd946d173ab318591ca5e184e1a89af91386eab8d261367a95428654be1075d201e4277a

  • \Users\Admin\AppData\Local\Temp\dll785.dll

    Filesize

    17KB

    MD5

    ccbfdf23c80e3eed8cb3e300cc6a7af8

    SHA1

    fbf306b146705ca9604cd67aea6f384173d3aa24

    SHA256

    d1bbc2e2ade383a996542bd84fb15a36c0fa41120bf01ab511a17aa69eed8cc0

    SHA512

    486c71f29be4e4c99335cadf4faa4389ac6c6fa75d25abb64ceb93e232884668584ba89400bd1e6e9d7c2206c69efdd8ee7168bf44d16596b917f0d24146e5d0