Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 06:07

General

  • Target

    a9e190239864b16315378411a3023bd0_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    a9e190239864b16315378411a3023bd0

  • SHA1

    a5c845a28da0917091d9670a57b74527fc88c1a6

  • SHA256

    6fbd2a6e8d537e75d7419c982c8c567cb047781b5e77bd479479164aacdf0cd2

  • SHA512

    42ca0f9249a0deaa06a61ffe23c40c0a0659b28746eb37272cde9c861670f360f05157ce55bb96111fce64156904537a27a21b51f2664ca629bd14e8b2cdd977

  • SSDEEP

    24576:dm2N1U5bhqhptFyslWzYtcydG/GahYezgCnSLDRWcHOnbpl3VrUTlQThXf1q:lUHq6s0zYtcgPau6gCSIgOVl3eTl6pt

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • UPX packed file 45 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9e190239864b16315378411a3023bd0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a9e190239864b16315378411a3023bd0_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\Cao.ime

    Filesize

    52KB

    MD5

    b60da4e2e5aceba3ce3d87ee2cd872ee

    SHA1

    9bbdbf1f3ce2c000a86e0473da756a4b1031db41

    SHA256

    b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453

    SHA512

    664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874

  • memory/2528-47-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-27-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-6-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-45-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-50-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-49-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-48-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-43-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-41-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-39-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-37-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-35-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-33-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-31-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-29-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-11-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-25-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-21-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-19-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-17-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-15-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-0-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-23-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-13-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-79-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-7-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-5-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-4-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-3-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-1-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-70-0x0000000003D30000-0x0000000003D3E000-memory.dmp

    Filesize

    56KB

  • memory/2528-72-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-73-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-74-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-75-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-76-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-77-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-78-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-9-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/2528-80-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-81-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-82-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-83-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-84-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-85-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/2528-86-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB