Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 20:13

General

  • Target

    ac6acd364b41686b4e4067a2ce1bcbb4_JaffaCakes118.exe

  • Size

    202KB

  • MD5

    ac6acd364b41686b4e4067a2ce1bcbb4

  • SHA1

    b82fbe7a43be70d4cf2aa960f3b0fe63a67f1da9

  • SHA256

    a9a5160dd963d7e8701d1952855583ec7ccfb552ac47cdd409727a27a4535080

  • SHA512

    9b0245f7b38ba9d6580fd5ca3fcf2e85e8b4d1610b88e059580159744d60d0c86f1eddd529d60c6940fde659352a3cb7c28fb4cf2be11587debcc030efb84295

  • SSDEEP

    3072:cZbeI76qLh6tPPyDEO54ToSbLhQghqp2TRaE6kiPUOIclpwpk36AxDD:O7uDnUGoSbLhYp2gEHaUOGG6ARD

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Drops file in System32 directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac6acd364b41686b4e4067a2ce1bcbb4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ac6acd364b41686b4e4067a2ce1bcbb4_JaffaCakes118.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:2284

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2460-7-0x00000000001C0000-0x00000000001EE000-memory.dmp

      Filesize

      184KB

    • memory/2460-0-0x0000000010410000-0x000000001043E000-memory.dmp

      Filesize

      184KB

    • memory/2460-8-0x00000000001C0000-0x00000000001EE000-memory.dmp

      Filesize

      184KB

    • memory/2460-18-0x00000000001C0000-0x00000000001EE000-memory.dmp

      Filesize

      184KB

    • memory/2460-24-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2460-23-0x00000000001C0000-0x00000000001EE000-memory.dmp

      Filesize

      184KB