Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 09:11

General

  • Target

    a1f837e39d1a7a0dabdb49034f52c582_JaffaCakes118.exe

  • Size

    387KB

  • MD5

    a1f837e39d1a7a0dabdb49034f52c582

  • SHA1

    ce1d4fefba19d2a2473adb2dbc6a76565e5d618e

  • SHA256

    48c3023e947f0076b0793ff034fec07208825c83395c04f9736a5f035a9221af

  • SHA512

    f1bfdf33ede2dea7c396f796838e00ba51485f66ce0c284d1895488038763623cbdc30ebcdc6be8498f28f0eaa9092cf26d797d5a2c8e0459e7e57c0b38445d4

  • SSDEEP

    6144:yAXKdCfpggm2knqybHIrqkSUVKZUkb3/eMmCzGac87abKNTAm:yhCxnmQyzaY8CfO+

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1f837e39d1a7a0dabdb49034f52c582_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a1f837e39d1a7a0dabdb49034f52c582_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\ProgramData\bG20302BlMkC20302\bG20302BlMkC20302.exe
      "C:\ProgramData\bG20302BlMkC20302\bG20302BlMkC20302.exe" "C:\Users\Admin\AppData\Local\Temp\a1f837e39d1a7a0dabdb49034f52c582_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\bG20302BlMkC20302\bG20302BlMkC20302

    Filesize

    208B

    MD5

    996149102044e72378978c9e87276a5c

    SHA1

    dc8d35e785405c53a88bda41cf8a803912bd062c

    SHA256

    1fbc0bd45158d5812706242c1aa8b42d55eb8d8e65e688b845db2fb3404d97cd

    SHA512

    f29e32464b07528899f1443e36d86e0c773d4bca52d7638b50790b0094ebe916a740e3fbc634e10652ece1edb169d1aa634311b5f123f98087019844ff20e15b

  • \ProgramData\bG20302BlMkC20302\bG20302BlMkC20302.exe

    Filesize

    387KB

    MD5

    592674b15b2dbc579e367a6e29c9a06e

    SHA1

    545694362bbacf0d4121e64db213afb3e0722ae4

    SHA256

    b9a5ddf593161d1e2eb0ea1e2034d7aa82cb6424c8b9fffcb07acae0f42e3c70

    SHA512

    4ebe59db4377039a808d4014c1db91c1535768066d02bbab009b4e2e4a86cf928cbc1b0edbe55c9673f8736a935955b063f81b173c7e72b6af9c37cfe8a0da11

  • memory/108-88-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

  • memory/108-203-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

  • memory/108-164-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

  • memory/108-86-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

  • memory/108-87-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

  • memory/3060-8-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/3060-0-0x0000000000230000-0x0000000000233000-memory.dmp

    Filesize

    12KB

  • memory/3060-161-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

  • memory/3060-1-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

  • memory/3060-198-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

  • memory/3060-2-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB