Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2024, 10:10

General

  • Target

    a6601396632bad6bd3aa07b7258426ed_JaffaCakes118.exe

  • Size

    129KB

  • MD5

    a6601396632bad6bd3aa07b7258426ed

  • SHA1

    f866a1fcef43fa20b05f21cae9862aac2f3e57d7

  • SHA256

    410c9c7bde0827f0b59ae71b87efa4826484575ed12e4b3904b1d22df18d6de4

  • SHA512

    22c7f685da05d6f36171c88837473bcb3b829abc02e2e8f76ac105c85acefd2c25f402e6f34b979d2d70927fc86cc845d5db4f73c34aa181fca50c627add8eb3

  • SSDEEP

    3072:s6K4roryHyyPpuSRvBPNEO51d3fKqKs9mUqOmFBf9jjD2F4Pe:s6wr0u2BP551lCqpmUZmf126

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6601396632bad6bd3aa07b7258426ed_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a6601396632bad6bd3aa07b7258426ed_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Windows\Bcihoa.exe
      C:\Windows\Bcihoa.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Bcihoa.exe

    Filesize

    129KB

    MD5

    a6601396632bad6bd3aa07b7258426ed

    SHA1

    f866a1fcef43fa20b05f21cae9862aac2f3e57d7

    SHA256

    410c9c7bde0827f0b59ae71b87efa4826484575ed12e4b3904b1d22df18d6de4

    SHA512

    22c7f685da05d6f36171c88837473bcb3b829abc02e2e8f76ac105c85acefd2c25f402e6f34b979d2d70927fc86cc845d5db4f73c34aa181fca50c627add8eb3

  • C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

    Filesize

    372B

    MD5

    b6de83a2295e22e284ac4f88299135a3

    SHA1

    2d054ea4322a9aebc85d000bbdd79fa404590fa6

    SHA256

    51a4306e57c962587b86df049a51873ee79d90e3512d57d667234687fab6abf3

    SHA512

    1b083f1fa4d35d546b554c1101592a0e2531de6d37e2903b3968c2594cc5616c9c86e3ebe73d50ad0124c3774d8b3d42c65ae5cda1a7839de5f61ab2c7b7339b

  • memory/2584-26843-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/2584-1-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/2584-0-0x00000000003B0000-0x00000000003DD000-memory.dmp

    Filesize

    180KB

  • memory/2584-43895-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-49357-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-49361-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-11-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-49355-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-10-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-49358-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-49360-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-43893-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-49362-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-49363-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-49364-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-49365-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-49366-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-49367-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/3064-49368-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB