Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    123s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 19:28

General

  • Target

    a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe

  • Size

    124KB

  • MD5

    a3d46b3546ab528e9d852a73186f9671

  • SHA1

    a07a7771d168effcd834aa9d2ac94d3214a5a809

  • SHA256

    e5777cdbf2bcfc7d6aec92d41d2634975518a2b0d20d6da136307c8302d6fd8d

  • SHA512

    3b19dc890029f33e650504c34599c1714fbc8af714e5b9f001e4a054049d22d99122f7d32694d3d93a85a531eaf3bea4e7b48c0b30ca432d491dd7439208926a

  • SSDEEP

    3072:F+vEEEIRBuTJQ5XD1/xGRm3MEn96K3H1UZpXbv9xD13:OEQBuyXD5nqx

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Unexpected DNS network traffic destination 10 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe
        3⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
          "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2060
          • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
            "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:848
            • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
              "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2700
              • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
                "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

    Filesize

    124KB

    MD5

    2d43b2f2241c2d1caf6542a75a2707b8

    SHA1

    b86a04c06314b0ce679ae1985ff19204982ab940

    SHA256

    df4529e5d3d2d68e44e0fdb191e8ef8acba657e16626e1119a1d81c10902fa91

    SHA512

    7c2f95b2ade2f489f9cafbefdd4c5731d5222347f1f47962d7d9fa15442dde44e7b34681a766881b9057c8dac11237051bcb32b12afb20208d1fc969afffc4c1

  • memory/848-56-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/848-42-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2160-14-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2160-21-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2160-6-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2160-59-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2160-16-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2160-36-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2160-12-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2160-8-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2160-10-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2160-35-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2616-2-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2616-5-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2616-4-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2616-19-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2700-60-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB