Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2024, 04:25

General

  • Target

    a560ac8a03166caf7c4d218e058a8b37_JaffaCakes118.exe

  • Size

    2.0MB

  • MD5

    a560ac8a03166caf7c4d218e058a8b37

  • SHA1

    e82181c268d28d3e731d85162702728027cf6b20

  • SHA256

    2337fb32f488b18ac24f0b38b90afc0d27d169a27af068018968b2f8226846b1

  • SHA512

    c2144383dbd15909cfbafe4b142c4275621716ca93899590b426eee72da8a4ee2ce2dc5c3354c22d5a2a13c6038a0743e4a25c618097e1d2942da282512b0589

  • SSDEEP

    49152:uTL2AHQ3gY2N6tg3JAslJElHEKbp8O/QK:u6312NYg3fEZv14K

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 10 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a560ac8a03166caf7c4d218e058a8b37_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a560ac8a03166caf7c4d218e058a8b37_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn OPStart /tr "\"C:\Program Files (x86)\oplsvc\OpenShopperC.exe\" \"/RUN\"" /sc onlogon /f /rl highest
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nso91D5.tmp\KillProcDLL.dll

    Filesize

    44KB

    MD5

    3599d30554ad65dc29fc689217d2152e

    SHA1

    8f5fcc313b667a1de2d56573bcf98d43fd0d4ff9

    SHA256

    1af3ac7d3176af42e8594ba0c33821d3318f4eea5cbb799bf8fab58e480efe0e

    SHA512

    846776b1d908b5204667715ffdfd3a6c76dface1677e8b1e5156ceac2ef0a739f68b48ccbb919c9e08d6ff359a93174bf0b90def7d48cee54cd3c41d8d8575f2

  • \Users\Admin\AppData\Local\Temp\nso91D5.tmp\System.dll

    Filesize

    11KB

    MD5

    00a0194c20ee912257df53bfe258ee4a

    SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

    SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

  • \Users\Admin\AppData\Local\Temp\nso91D5.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    e54eb27fb5048964e8d1ec7a1f72334b

    SHA1

    2b76d7aedafd724de96532b00fbc6c7c370e4609

    SHA256

    ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

    SHA512

    c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

  • \Users\Admin\AppData\Local\Temp\nso91D5.tmp\version.dll

    Filesize

    6KB

    MD5

    ebc5bb904cdac1c67ada3fa733229966

    SHA1

    3c6abfa0ddef7f3289f38326077a5041389b15d2

    SHA256

    3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75

    SHA512

    fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f

  • memory/1700-9-0x00000000002F0000-0x00000000002FC000-memory.dmp

    Filesize

    48KB

  • memory/1700-51-0x00000000002F0000-0x00000000002FC000-memory.dmp

    Filesize

    48KB