Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    8s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2024, 19:36

General

  • Target

    a7f13bf164d1009e0362c73873084f42_JaffaCakes118.exe

  • Size

    740KB

  • MD5

    a7f13bf164d1009e0362c73873084f42

  • SHA1

    be90e8a7881b61e30f9401e640a156d0858dc5c7

  • SHA256

    be3424fe002aabf42d4c41bf0ef110663d4459c5845aed5e706ddba955c1edca

  • SHA512

    ac1e5797fb3b8a89a974eff53c4911762b09bdd7affb32914f571877a0f6d76b02dc5ccecedcafe76b86fe21e48ae14d1d7b9ce95649abf974e4ed315e0369be

  • SSDEEP

    12288:7IAKJGD++o3bJ8xQUL8O6jfcWYXVlmYTb8tzqo7ZF3Z4mxxHQgwKQt/dam6:Ke+zbKQqr+fcWxW8j7ZQmXwZKm/dah

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7f13bf164d1009e0362c73873084f42_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a7f13bf164d1009e0362c73873084f42_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2628
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE
      2⤵
      • Executes dropped EXE
      PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE

    Filesize

    345KB

    MD5

    8f624818c4fe4e49ebc7f4b6aeeb526c

    SHA1

    41a492cec7d094ecde2e3e276ba4eb58a5d26046

    SHA256

    6be8d2cdca243450a7915e19c65573aecd611fea3f7e9735e48489af31376e5b

    SHA512

    389b2780422002e2e277c858b158aac5529ae2242a4e25c4c072c85ac33ada53f72f3464925bc37b1dd8182c7dadc3c64e36d6daa441e53a556ddd0efc3c2a7f

  • memory/2628-42-0x00000000001C0000-0x0000000000214000-memory.dmp

    Filesize

    336KB

  • memory/2628-41-0x0000000000D80000-0x0000000000D81000-memory.dmp

    Filesize

    4KB

  • memory/2628-40-0x0000000000D90000-0x0000000000D91000-memory.dmp

    Filesize

    4KB

  • memory/2628-39-0x0000000000930000-0x0000000000931000-memory.dmp

    Filesize

    4KB

  • memory/2628-38-0x0000000000940000-0x0000000000941000-memory.dmp

    Filesize

    4KB

  • memory/2628-37-0x0000000000D50000-0x0000000000D51000-memory.dmp

    Filesize

    4KB

  • memory/2628-36-0x0000000000D70000-0x0000000000D71000-memory.dmp

    Filesize

    4KB

  • memory/2628-35-0x00000000008A0000-0x00000000008A1000-memory.dmp

    Filesize

    4KB

  • memory/2628-34-0x0000000000910000-0x0000000000911000-memory.dmp

    Filesize

    4KB

  • memory/2628-33-0x00000000008E0000-0x00000000008E1000-memory.dmp

    Filesize

    4KB

  • memory/2628-32-0x00000000008F0000-0x00000000008F1000-memory.dmp

    Filesize

    4KB

  • memory/2628-31-0x0000000000460000-0x0000000000461000-memory.dmp

    Filesize

    4KB

  • memory/2628-30-0x0000000000890000-0x0000000000891000-memory.dmp

    Filesize

    4KB

  • memory/2628-29-0x0000000000900000-0x0000000000901000-memory.dmp

    Filesize

    4KB

  • memory/2628-28-0x00000000008B0000-0x00000000008B1000-memory.dmp

    Filesize

    4KB

  • memory/2628-27-0x00000000008D0000-0x00000000008D1000-memory.dmp

    Filesize

    4KB

  • memory/2628-26-0x0000000003180000-0x0000000003181000-memory.dmp

    Filesize

    4KB

  • memory/2628-25-0x0000000003180000-0x0000000003181000-memory.dmp

    Filesize

    4KB

  • memory/2628-24-0x0000000003180000-0x0000000003181000-memory.dmp

    Filesize

    4KB

  • memory/2628-23-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-22-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-21-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-20-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-19-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-18-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-17-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-16-0x0000000000300000-0x0000000000301000-memory.dmp

    Filesize

    4KB

  • memory/2628-15-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-14-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-13-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-12-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-11-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-10-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-9-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2628-8-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2628-7-0x0000000000180000-0x0000000000181000-memory.dmp

    Filesize

    4KB

  • memory/2628-6-0x0000000000190000-0x0000000000191000-memory.dmp

    Filesize

    4KB

  • memory/2628-5-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

  • memory/2628-4-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2628-3-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2628-2-0x0000000001000000-0x000000000112B000-memory.dmp

    Filesize

    1.2MB

  • memory/2628-51-0x0000000003600000-0x00000000036C6000-memory.dmp

    Filesize

    792KB

  • memory/2628-50-0x0000000003600000-0x00000000036C6000-memory.dmp

    Filesize

    792KB

  • memory/2628-53-0x0000000001000000-0x000000000112B000-memory.dmp

    Filesize

    1.2MB

  • memory/2628-68-0x0000000003180000-0x0000000003181000-memory.dmp

    Filesize

    4KB

  • memory/2628-67-0x0000000003180000-0x0000000003181000-memory.dmp

    Filesize

    4KB

  • memory/2628-66-0x0000000003180000-0x0000000003181000-memory.dmp

    Filesize

    4KB

  • memory/2628-65-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-64-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-63-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-62-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-61-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-60-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-59-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-58-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-57-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-56-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-55-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2628-54-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/2764-52-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB