Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 17:14

General

  • Target

    8b3f5a4d9bc9ff5a8c8e146a9cb3e3c9_JaffaCakes118.exe

  • Size

    267KB

  • MD5

    8b3f5a4d9bc9ff5a8c8e146a9cb3e3c9

  • SHA1

    219e9441da78c9a29141ae869f80a987ef5074a2

  • SHA256

    2766755090e1425a9bbdbaa3652d5ffa3e113bcf9621a977e122c12c063d642d

  • SHA512

    3b954274e3fde0e31de550b71f4e63ab894fd2a2dc47a2c9f81294fa559e8b9c3d9b4b95332cf4910546df88ebac4de8afb0fc5890c22bc5c49139c91fbcb74f

  • SSDEEP

    6144:PllslxMfjmxPA2XK/l78oJ5sXXZnW4j9NY:IlEqxPlX078oJOZnd9NY

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b3f5a4d9bc9ff5a8c8e146a9cb3e3c9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8b3f5a4d9bc9ff5a8c8e146a9cb3e3c9_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2208

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2208-0-0x0000000000400000-0x0000000000510000-memory.dmp

    Filesize

    1.1MB

  • memory/2208-1-0x00000000003B0000-0x00000000003FF000-memory.dmp

    Filesize

    316KB

  • memory/2208-2-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2208-12-0x0000000000850000-0x0000000000902000-memory.dmp

    Filesize

    712KB

  • memory/2208-10-0x0000000000850000-0x0000000000902000-memory.dmp

    Filesize

    712KB

  • memory/2208-8-0x0000000000850000-0x0000000000902000-memory.dmp

    Filesize

    712KB

  • memory/2208-4-0x0000000000850000-0x0000000000902000-memory.dmp

    Filesize

    712KB

  • memory/2208-6-0x0000000000850000-0x0000000000902000-memory.dmp

    Filesize

    712KB

  • memory/2208-14-0x0000000000850000-0x0000000000902000-memory.dmp

    Filesize

    712KB

  • memory/2208-15-0x0000000000400000-0x0000000000510000-memory.dmp

    Filesize

    1.1MB

  • memory/2208-16-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-20-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-18-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-35-0x0000000000340000-0x0000000000341000-memory.dmp

    Filesize

    4KB

  • memory/2208-42-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-43-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-44-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-45-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-46-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-47-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-48-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-49-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-50-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-51-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-52-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-53-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-54-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-56-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-55-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-83-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-82-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-81-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-80-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-79-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-78-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-77-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-76-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-75-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-74-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-73-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-72-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-71-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-70-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-69-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-68-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-67-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-66-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-65-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-64-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-63-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-62-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-61-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-60-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-59-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-58-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-57-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-84-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-86-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-85-0x0000000002390000-0x0000000002448000-memory.dmp

    Filesize

    736KB

  • memory/2208-170-0x00000000003B0000-0x00000000003FF000-memory.dmp

    Filesize

    316KB

  • memory/2208-172-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB