Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    17s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 23:37

General

  • Target

    b57f7afafc40fd8ee8a0312eea4382cd_JaffaCakes118.exe

  • Size

    154KB

  • MD5

    b57f7afafc40fd8ee8a0312eea4382cd

  • SHA1

    8ab00b5eb8607c7a04ddc881b2731728ca6a7167

  • SHA256

    f8c1c23ace9dbcc7aec6e9fe47c2dd39ceea452af5d9ba1086e85ad31e93a8c0

  • SHA512

    1a0c073d0d252302b6ec619f14f25fcf1f470854242c4c25eb9683aec8909f8e481b26df0a4d2f8148dbfba637515c78daa2a2e952dd39e60b1b1e68f34d35f2

  • SSDEEP

    3072:3+hOPTdZ/ljsHm/svxTuhaCSzaCx0MDi7sfvyEFQimi5WEpk:3QKTdnsvx6SOe0MD4sfvyyBcgk

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b57f7afafc40fd8ee8a0312eea4382cd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b57f7afafc40fd8ee8a0312eea4382cd_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:828
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c delplme.bat
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2484
  • C:\Windows\avp.exe
    C:\Windows\avp.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Windows\avp.exe
      C:\Windows\avp.exe
      2⤵
      • Executes dropped EXE
      PID:2240

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\delplme.bat

    Filesize

    306B

    MD5

    474efed1b518fc6ec40bd02e4488786e

    SHA1

    78f82a17d6891dc48907b4d05887302f47c451ee

    SHA256

    1babdf62dfd456af216c0552494524b66baff0a0efecb0d607ed7ea42fcedacd

    SHA512

    68d33b67db3c4b537078a81fbe7aecf86b338abc3ed25f12169807feb206efcf678efc327d91696cfc8aaf29b9a7ed8273743f894e2881abe177443bb6c8eb8a

  • C:\Windows\avp.exe

    Filesize

    21KB

    MD5

    d96771acf8211756a9c1ea512575c79a

    SHA1

    4220273f68f65061abf8e1ac87f35364fa984c6c

    SHA256

    d36d9c6b553e95820dde6a45f93ce0a186f77123b6c76fd5a2a6fb260ccc0fe5

    SHA512

    3a631a72c0310fea6199aad6d9b726581afacbb6e1c1cdd87ae9825ab81de73806d7a9d56f22709f3830a2cbdd5a7afd7a9333373bfe4a07db2077326bd35b4b

  • \Windows\SysWOW64\hvsound2.dll

    Filesize

    233KB

    MD5

    3c56d6f42f5a53e0a6b632390ed93c32

    SHA1

    5717b0a6690b5416ab0c658135be8f0b0c3965e5

    SHA256

    94dbf1c71769616f7fb78b10f8a781b93b6206b800096a22da868945dfb13339

    SHA512

    4572a6d897dd20c3046574da782a3c458187d198e79c52ea91b3c11631cc3ffd38ae80e8d9a7c18e0b9c4f301f9935d48415e72a7799ad4979bd011817d4f537

  • memory/828-19-0x0000000001DC0000-0x0000000001E06000-memory.dmp

    Filesize

    280KB

  • memory/828-1-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/828-2-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/828-29-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/828-15-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/828-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2240-16-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2240-10-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2240-17-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2240-7-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2240-13-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2240-22-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2240-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2324-12-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB

  • memory/2324-5-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB