Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    14/08/2024, 12:36

General

  • Target

    962137242d717cfc0fe57115a5dff2b9_JaffaCakes118.exe

  • Size

    2.3MB

  • MD5

    962137242d717cfc0fe57115a5dff2b9

  • SHA1

    b59f6b92ec6dc07df1e026ed5cfb32fc7c6f6307

  • SHA256

    f4abe418a9a6de92445b48823985b827db8988aaeae44ab70fa42a8dddef1029

  • SHA512

    fc1164c60130ab13c150b0798076d97401e568d808f043ea910b6b6432f01e9eb2b7ca1379f977c287609a6d47ecefd3fd7b1316478cc6a5e8adad5988767c3a

  • SSDEEP

    49152:Yi8J+zfdrtA8IVvP3hXzP3uqvofRhTF4Fce13OdHT7+SSKf6yzUBf+:Yi8J+zRtA1VHhDP3u7fRsFZoJ6yzUBf+

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\962137242d717cfc0fe57115a5dff2b9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\962137242d717cfc0fe57115a5dff2b9_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:824
    • C:\Users\Admin\AppData\Local\Temp\is-CLLUM.tmp\is-T0R8U.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-CLLUM.tmp\is-T0R8U.tmp" /SL4 $301CA "C:\Users\Admin\AppData\Local\Temp\962137242d717cfc0fe57115a5dff2b9_JaffaCakes118.exe" 2067478 50688
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-153RR.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-CLLUM.tmp\is-T0R8U.tmp

    Filesize

    640KB

    MD5

    77bb296ad04657c17de13534a052aa89

    SHA1

    806db111c1f412b8f94b52c810a8836c99a7a9ec

    SHA256

    e6b4e0f71ce020d44ba42b2fa6662326632a0c4cf4afc8eb15b2f7f22e1c30a7

    SHA512

    6c70909de664e234232cecbca9fe893222bcc24867bbc217933abfc54242caab83b570b1a8e9a6fb25d79072e66b68e73935111ef88b774e458d4ea863438ce8

  • memory/824-2-0x0000000000401000-0x000000000040A000-memory.dmp

    Filesize

    36KB

  • memory/824-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/824-15-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1404-16-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB