Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2024, 05:49

General

  • Target

    ae15e63bf0c4f026a3e3a744f191f3b5_JaffaCakes118.exe

  • Size

    157KB

  • MD5

    ae15e63bf0c4f026a3e3a744f191f3b5

  • SHA1

    38e4729d2f43d41c62a96c958834654095966935

  • SHA256

    41bdb2a156eb347636f995c8665d9b8f57f018bd6fa4d31f3ae84f81a1f864d3

  • SHA512

    1d8f70bf9f4fb814a2445e2047956922dde765ca2974d7cf18efd4cc4180176200a7b3e6f6c2cea3dcdf8e91788c4fd7c1e42e1eb53e418ffddf610534cc9f8d

  • SSDEEP

    3072:OLg7gSiEuhSuvOJG05Wv9fhD62mifiXKXVrADfH5THU8D9N3GhdWg/Hdi:Jsdhdv7XVfhD62NiXiVrADRT0rWg/HI

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 20 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae15e63bf0c4f026a3e3a744f191f3b5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ae15e63bf0c4f026a3e3a744f191f3b5_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1628
    • \??\c:\program files (x86)\common files\microsoft shared\vsta\pipeline.v10.0\contracts\contractstudio.exe
      "c:\program files (x86)\common files\microsoft shared\vsta\pipeline.v10.0\contracts\contractstudio.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:2428
    • \??\c:\program files (x86)\google\update\updateupdate1.3.36.151.exe
      "c:\program files (x86)\google\update\updateupdate1.3.36.151.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:1288
    • \??\c:\program files (x86)\windows photo viewer\ja-jp\systemoperating.exe
      "c:\program files (x86)\windows photo viewer\ja-jp\systemoperating.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:1584
    • \??\c:\program files (x86)\adobe\reader 9.0\reader\browser\adobenppdf32.exe
      "c:\program files (x86)\adobe\reader 9.0\reader\browser\adobenppdf32.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:1268

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\ContractStudio.exe

    Filesize

    157KB

    MD5

    ae15e63bf0c4f026a3e3a744f191f3b5

    SHA1

    38e4729d2f43d41c62a96c958834654095966935

    SHA256

    41bdb2a156eb347636f995c8665d9b8f57f018bd6fa4d31f3ae84f81a1f864d3

    SHA512

    1d8f70bf9f4fb814a2445e2047956922dde765ca2974d7cf18efd4cc4180176200a7b3e6f6c2cea3dcdf8e91788c4fd7c1e42e1eb53e418ffddf610534cc9f8d

  • memory/1268-313-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1288-166-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1288-626-0x0000000000180000-0x00000000001CE000-memory.dmp

    Filesize

    312KB

  • memory/1288-247-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1288-167-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1584-268-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1584-218-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1584-219-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1628-29-0x0000000003240000-0x000000000328E000-memory.dmp

    Filesize

    312KB

  • memory/1628-37-0x0000000003240000-0x000000000328E000-memory.dmp

    Filesize

    312KB

  • memory/1628-38-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/1628-36-0x0000000000170000-0x0000000000191000-memory.dmp

    Filesize

    132KB

  • memory/1628-46-0x0000000003240000-0x000000000328E000-memory.dmp

    Filesize

    312KB

  • memory/1628-45-0x0000000003240000-0x000000000328E000-memory.dmp

    Filesize

    312KB

  • memory/1628-88-0x0000000003240000-0x000000000328E000-memory.dmp

    Filesize

    312KB

  • memory/1628-5-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1628-120-0x0000000002960000-0x00000000029AE000-memory.dmp

    Filesize

    312KB

  • memory/1628-579-0x0000000002960000-0x00000000029AE000-memory.dmp

    Filesize

    312KB

  • memory/1628-154-0x0000000002960000-0x00000000029AE000-memory.dmp

    Filesize

    312KB

  • memory/1628-39-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1628-30-0x0000000003240000-0x000000000328E000-memory.dmp

    Filesize

    312KB

  • memory/1628-216-0x0000000002960000-0x00000000029AE000-memory.dmp

    Filesize

    312KB

  • memory/1628-0-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1628-1-0x0000000000170000-0x0000000000191000-memory.dmp

    Filesize

    132KB

  • memory/1628-2-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1628-3-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/1628-4-0x0000000000415000-0x000000000043B000-memory.dmp

    Filesize

    152KB

  • memory/2428-122-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2428-95-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB