Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2024, 01:21

General

  • Target

    a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe

  • Size

    748KB

  • MD5

    a4d5eeb07bb81d0c99911a57a02d058b

  • SHA1

    904574e54f910793a3fe9f912d0911293350e4f4

  • SHA256

    92d1c63c4d8eb86dcb20961260b3cc92cafa4fd22889ba04ce63d7467abc67b7

  • SHA512

    1782cfcf668ebce1d71705d4f4da79a17ae1ad703850803ae3aab41f2002f5bfa3dbb4d951c55f7f4526b03e2db62db0e9d9553a46f820a25406b7ba09ac4df3

  • SSDEEP

    12288:NYLIHAa68vN/+nc6FwDqCpi96x58P1lAXGNrspt95Ehay8urkPz0TuTcj06K6:hgaJv5+ckw3pia5svT8uG0TuQjpR

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Users\Admin\AppData\Local\Temp\a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Recycle.Bin\B6232F3A1B4.exe
        "C:\Recycle.Bin\B6232F3A1B4.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Recycle.Bin\B6232F3A1B4.exe
          "C:\Recycle.Bin\B6232F3A1B4.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2856
          • C:\Users\Admin\AppData\Local\Temp\KKNEA7E.exe
            "C:\Users\Admin\AppData\Local\Temp\KKNEA7E.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer Phishing Filter
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Recycle.Bin\9720FCB6A2EC0CE

    Filesize

    492KB

    MD5

    383ebf8a32a4a4679ea335c546d71f9f

    SHA1

    12e5c95df63f2cc00df20e5c0fe8dc5c39343263

    SHA256

    b7b1103b82e47f8c39ab5e8f56150de37b06d579944c6c051c2b569be992aa00

    SHA512

    a291ab3d4cf2b5bf4ec03d345a4b2656a46f67ba4e4ffdbee37085b105162491dbf1e736eae1dea204398229decd5f8c853c82a04a4426c960511863aa7fa77a

  • C:\Users\Admin\AppData\Local\Temp\KKNEA7E.exe

    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • \Recycle.Bin\B6232F3A1B4.exe

    Filesize

    748KB

    MD5

    a4d5eeb07bb81d0c99911a57a02d058b

    SHA1

    904574e54f910793a3fe9f912d0911293350e4f4

    SHA256

    92d1c63c4d8eb86dcb20961260b3cc92cafa4fd22889ba04ce63d7467abc67b7

    SHA512

    1782cfcf668ebce1d71705d4f4da79a17ae1ad703850803ae3aab41f2002f5bfa3dbb4d951c55f7f4526b03e2db62db0e9d9553a46f820a25406b7ba09ac4df3

  • memory/2612-95-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-71-0x00000000001B0000-0x00000000001FE000-memory.dmp

    Filesize

    312KB

  • memory/2612-155-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-151-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-152-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-153-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-154-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-149-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-150-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-148-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-83-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-99-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-119-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-127-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-126-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-125-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-124-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-140-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-139-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-138-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-137-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-136-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-135-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-123-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-118-0x0000000075BF0000-0x0000000075CF0000-memory.dmp

    Filesize

    1024KB

  • memory/2612-117-0x0000000075C07000-0x0000000075C09000-memory.dmp

    Filesize

    8KB

  • memory/2612-116-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-93-0x0000000000E10000-0x0000000000E5C000-memory.dmp

    Filesize

    304KB

  • memory/2612-66-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-47-0x00000000001B0000-0x00000000001FE000-memory.dmp

    Filesize

    312KB

  • memory/2612-54-0x00000000001B0000-0x00000000001FE000-memory.dmp

    Filesize

    312KB

  • memory/2612-55-0x0000000001001000-0x0000000001002000-memory.dmp

    Filesize

    4KB

  • memory/2612-56-0x0000000001000000-0x0000000001004000-memory.dmp

    Filesize

    16KB

  • memory/2612-57-0x00000000001B0000-0x00000000001FE000-memory.dmp

    Filesize

    312KB

  • memory/2612-96-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-58-0x00000000001B0000-0x00000000001FE000-memory.dmp

    Filesize

    312KB

  • memory/2612-78-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-92-0x0000000000E10000-0x0000000000E5C000-memory.dmp

    Filesize

    304KB

  • memory/2612-70-0x0000000000DB0000-0x0000000000E04000-memory.dmp

    Filesize

    336KB

  • memory/2612-91-0x0000000000DB0000-0x0000000000E04000-memory.dmp

    Filesize

    336KB

  • memory/2612-89-0x0000000000DB0000-0x0000000000E04000-memory.dmp

    Filesize

    336KB

  • memory/2612-88-0x0000000000E10000-0x0000000000E5C000-memory.dmp

    Filesize

    304KB

  • memory/2612-86-0x0000000000DB0000-0x0000000000E04000-memory.dmp

    Filesize

    336KB

  • memory/2612-85-0x0000000000510000-0x0000000000516000-memory.dmp

    Filesize

    24KB

  • memory/2612-94-0x0000000000E10000-0x0000000000E5C000-memory.dmp

    Filesize

    304KB

  • memory/2612-97-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-82-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-81-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-80-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-79-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-87-0x00000000001B0000-0x00000000001FE000-memory.dmp

    Filesize

    312KB

  • memory/2612-84-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2612-77-0x00000000001B0000-0x00000000001FE000-memory.dmp

    Filesize

    312KB

  • memory/2612-76-0x00000000001B0000-0x00000000001FE000-memory.dmp

    Filesize

    312KB

  • memory/2612-75-0x00000000001B0000-0x00000000001FE000-memory.dmp

    Filesize

    312KB

  • memory/2856-36-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2856-42-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/2856-52-0x00000000001B0000-0x00000000001FE000-memory.dmp

    Filesize

    312KB

  • memory/2856-33-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3052-115-0x00000000003A0000-0x00000000003A1000-memory.dmp

    Filesize

    4KB

  • memory/3052-5-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3052-18-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3052-14-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/3052-13-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/3052-98-0x00000000003A0000-0x00000000003A1000-memory.dmp

    Filesize

    4KB

  • memory/3052-6-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3052-114-0x0000000077D1F000-0x0000000077D21000-memory.dmp

    Filesize

    8KB

  • memory/3052-7-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3052-9-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3052-11-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3052-12-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3052-10-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3052-8-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3052-2-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3052-4-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB