Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    14/08/2024, 11:35

General

  • Target

    95efec9c49c6335f5d5de7f7550fd07e_JaffaCakes118.exe

  • Size

    264KB

  • MD5

    95efec9c49c6335f5d5de7f7550fd07e

  • SHA1

    8f47b8a288dd08e436725774ab7034b0bf004ac5

  • SHA256

    a1152c0747e18e3bf452ab32cad66e7447562dbe17bf34400cefeafe09951a2a

  • SHA512

    b3803002cb42165df3b8fe7ed63789b106e34b4b0c50312853db8790620c1e6a23611c4ad5f10f8f63104e0026d8a7eb5a754613d107f2d5011754f2b969ba25

  • SSDEEP

    6144:xlUjEKIhdz4Tlw0bpWtVUrTocNBGWI/3JeY7Ko8CaZ:jUYKOWTlf7rToSBI3WohaZ

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies WinLogon 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95efec9c49c6335f5d5de7f7550fd07e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\95efec9c49c6335f5d5de7f7550fd07e_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2244

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2244-0-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/2244-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2244-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2244-3-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2244-4-0x0000000002340000-0x00000000023EA000-memory.dmp

    Filesize

    680KB

  • memory/2244-6-0x0000000002340000-0x00000000023EA000-memory.dmp

    Filesize

    680KB

  • memory/2244-8-0x0000000002340000-0x00000000023EA000-memory.dmp

    Filesize

    680KB

  • memory/2244-14-0x0000000002340000-0x00000000023EA000-memory.dmp

    Filesize

    680KB

  • memory/2244-12-0x0000000002340000-0x00000000023EA000-memory.dmp

    Filesize

    680KB

  • memory/2244-10-0x0000000002340000-0x00000000023EA000-memory.dmp

    Filesize

    680KB

  • memory/2244-15-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/2244-16-0x00000000024F0000-0x00000000025A9000-memory.dmp

    Filesize

    740KB

  • memory/2244-18-0x00000000024F0000-0x00000000025A9000-memory.dmp

    Filesize

    740KB

  • memory/2244-33-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

    Filesize

    4KB

  • memory/2244-64-0x00000000024F0000-0x00000000025A9000-memory.dmp

    Filesize

    740KB

  • memory/2244-61-0x00000000025D0000-0x00000000025D1000-memory.dmp

    Filesize

    4KB

  • memory/2244-58-0x00000000025C0000-0x00000000025C1000-memory.dmp

    Filesize

    4KB

  • memory/2244-55-0x00000000025B0000-0x00000000025B1000-memory.dmp

    Filesize

    4KB

  • memory/2244-54-0x00000000025B0000-0x00000000025B1000-memory.dmp

    Filesize

    4KB

  • memory/2244-53-0x0000000002110000-0x0000000002111000-memory.dmp

    Filesize

    4KB

  • memory/2244-51-0x00000000020F0000-0x00000000020F1000-memory.dmp

    Filesize

    4KB

  • memory/2244-50-0x0000000002100000-0x0000000002101000-memory.dmp

    Filesize

    4KB

  • memory/2244-47-0x00000000020F0000-0x00000000020F1000-memory.dmp

    Filesize

    4KB

  • memory/2244-46-0x00000000020E0000-0x00000000020E1000-memory.dmp

    Filesize

    4KB

  • memory/2244-44-0x00000000020C0000-0x00000000020C1000-memory.dmp

    Filesize

    4KB

  • memory/2244-43-0x00000000020D0000-0x00000000020D1000-memory.dmp

    Filesize

    4KB

  • memory/2244-39-0x00000000020B0000-0x00000000020B1000-memory.dmp

    Filesize

    4KB

  • memory/2244-37-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

    Filesize

    4KB

  • memory/2244-36-0x00000000020A0000-0x00000000020A1000-memory.dmp

    Filesize

    4KB

  • memory/2244-32-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

    Filesize

    4KB

  • memory/2244-30-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2244-29-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2244-26-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2244-25-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2244-23-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2244-22-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

  • memory/2244-21-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

  • memory/2244-19-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2244-67-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB