Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    12/08/2024, 12:20

General

  • Target

    8eb986f2ab4fded50c826f5f0b0acce6_JaffaCakes118.exe

  • Size

    380KB

  • MD5

    8eb986f2ab4fded50c826f5f0b0acce6

  • SHA1

    db0041efcc5ffe447255aaa13219dc9183fc84ba

  • SHA256

    0ec30afad62550d6c6e1a66c48b464e8f2feb38255725e1d806560fedc9b3ca5

  • SHA512

    980bbdb908c74d1e7851f57022470e20bab4b4943f63a4a5225b2a409e71ec5f99f5275178391b4aa35c4512813699b7b8367a4588a6072eb43ce149bbcb498f

  • SSDEEP

    6144:trbcJpraOqZlvfQZVpadq/qapWr+Ai6k2okrIR3Z05jF34HaN+0cSDc/TB:50uOqz03p8y6k2oFR3i5jt46NHc1TB

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8eb986f2ab4fded50c826f5f0b0acce6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8eb986f2ab4fded50c826f5f0b0acce6_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\SSESTART\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\SSESTART\Setup.exe" C:\Users\Admin\AppData\Local\Temp\SSEset.dat /BS
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\SSESTART\Setup.exe

    Filesize

    350KB

    MD5

    d6e95508eaf5933eb86f47024df5b4cb

    SHA1

    57eadbb5fc01be87c584c79c6f3462d249424315

    SHA256

    ae81a62c90d1df17ea2029444c53e1c43a84e963850b81f9b21677a799f385ee

    SHA512

    17368c6d2611c3713c9be1577d37754fc085e48c7b8c79e12d24cae930cbbbe5e65688e66e15cb18555ebeaf12a8734d17bf4e27389c7b6afffa1521457cc1ab

  • memory/1776-19-0x0000000000400000-0x0000000000539000-memory.dmp

    Filesize

    1.2MB

  • memory/1776-22-0x0000000000400000-0x0000000000539000-memory.dmp

    Filesize

    1.2MB

  • memory/2996-6-0x0000000003410000-0x0000000003549000-memory.dmp

    Filesize

    1.2MB

  • memory/2996-16-0x0000000003410000-0x0000000003549000-memory.dmp

    Filesize

    1.2MB