Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    12/08/2024, 10:44

General

  • Target

    8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe

  • Size

    91KB

  • MD5

    8e700237875b49ca20eb2cadecc8746d

  • SHA1

    98f82bc41b8caced547d1c1b9fb6aa2281f855bf

  • SHA256

    5ca47bbbe99b3d58aeece8d2ca5768c03d4c1a3fc344ecefa9c160383a66e8d1

  • SHA512

    b80fba99fd38f946299b5dcba6609c3d547ba4d85011eed5a918a639599d59212fc8463f32129606edc7e2f13c4bc2de6cf890676a3b5f1c983d2a375a8d30d7

  • SSDEEP

    1536:ZiDLG7z8p+SZjBHdEhIxBtS5Q5grdU3+kNS9Y/bmF6uIo6nX7mNeomBZzJ1J+B0Z:ZifEzyPHdEaaQ5g2Ow2Y/bmF65NCNeoQ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3020
      • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2308
        • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
          "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:348
          • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
            "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

    Filesize

    91KB

    MD5

    cc38da31b230ab7cf2be78ec470cb68c

    SHA1

    93e5e9605bf761ba9bf168695ced8f179c9c159b

    SHA256

    05e5a62b3bc36f098521779474f2c1e6d050590df9f4c37686624180115cf9f6

    SHA512

    59731b10913f2185f690ec34db0187390bfbdda5c1a704fd91999bef7a85f4f25234c125de5b884ceff1986b53fda3f7d63f2302d6755c31d6c218ff6cc091da

  • memory/348-41-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3020-0-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3020-10-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3020-8-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3020-6-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3020-4-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3020-2-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3020-12-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3020-39-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB