Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2024, 10:21

General

  • Target

    aedb20ea55c26ee18ce4883090613236_JaffaCakes118.exe

  • Size

    156KB

  • MD5

    aedb20ea55c26ee18ce4883090613236

  • SHA1

    df40982d37ace39c19c7fffd368b75782961ca2c

  • SHA256

    33e5ecd1521f516eca96da39623c291ec4632d1909ddbdf517f1abcd22fc7911

  • SHA512

    073d233ecc9c78aa18755a92daaf034f5042bc0e9b724e4cd657376ba7ce0aef7b5bad828961bf9346d9df771e9b8e6e3cb007c122c644c5b1662235a5938d5a

  • SSDEEP

    3072:gLySkYWrO0VctCPmJIHE+gRyRSIuznLstk4oQZiER6TWMIRJ:T8GPctCrEaRQLpWP6TWMu

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aedb20ea55c26ee18ce4883090613236_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\aedb20ea55c26ee18ce4883090613236_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Users\Admin\feiogu.exe
      "C:\Users\Admin\feiogu.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\feiogu.exe

    Filesize

    156KB

    MD5

    5d8cfad2e568276e29cd24dafce488c2

    SHA1

    958a551090214b539933277eb05bac7efb34ce9c

    SHA256

    ca0b3e586e90e37c950ac4447232fa79bbc1a1dba4d010e496d93eda561dcbb4

    SHA512

    0b43cb3edfdce7ef33b8f9f3c3134a659eee35c105c6334fa2dd2f7bf41538776f2bcbb621270c1c15c7c937b2109e806b6fff22a7807f962cbb893b8b7c4f69