Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 14:06

General

  • Target

    b3c2ab438cc2efd085914345badac554_JaffaCakes118.exe

  • Size

    3.6MB

  • MD5

    b3c2ab438cc2efd085914345badac554

  • SHA1

    a24e2a4c4a5ef80dd4df0341998ff099a844edd0

  • SHA256

    a50575b36489d8366f7d72df5bae30a17ae7872220e0685ecdb55bdea6a1b2ae

  • SHA512

    e243812eba8c4ea6003fb416194ad27b014e2058d686fe830e5207fbc6a5c2edf7de029b3e0e4d7b34f3279748c640aff0ea26f9bc70a99f95e49fa0dc527081

  • SSDEEP

    49152:Z0c24StiTTsdoNDjoJSFWWCycq1mFDbPd3Zm7BmKGMkO/VcmFJRUZYUxPIaKLmEG:Z36ivJDiSFdph1mPYAlO/hJ6ZYWWqnd

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3c2ab438cc2efd085914345badac554_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b3c2ab438cc2efd085914345badac554_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Users\Admin\AppData\Local\Temp\nst8E9A.tmp\InstGameInfoHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\nst8E9A.tmp\InstGameInfoHelper.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      PID:2536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabF1D0.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarF1E3.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\nst8E9A.tmp\ftdownload.dat

    Filesize

    512B

    MD5

    438fe103f77b49b6d6d0328ef0428b2d

    SHA1

    c3f08926eeb5c6ed6f9d8a0bf49961c4b6609de3

    SHA256

    9ee94683e7dfafe7c9ab925b5525706be3a7012e3b1d3c5b1783ab90dd027875

    SHA512

    4fc140250c455ba7004e28fb8b5589f9d527af1a17f37e37e8cee0ad12f663b8dd8275b80b66d643a00cc691c957311cf409ef8c6beee4729e5e703d5582b920

  • C:\Users\Admin\AppData\Local\Temp\nst8E9A.tmp\gametitle.txt

    Filesize

    48B

    MD5

    4cdf888fbf69e24dc89854bce68cbbc3

    SHA1

    900825523ff88817a6c2131d86cb3acc4f1b6e93

    SHA256

    054aafa031c994727593bd63e842921f2e4271072d17fc465fc538fca48f739b

    SHA512

    5b76b55c4d5f74aff99de6c08c5d307c8f42f01f66b00c0a4db8980106ed98e7183a148f3e600ccc8c1812f4685da88790b607395cf2971aa9c029c5126731a2

  • C:\Users\Admin\AppData\Local\Temp\nst8E9A.tmp\tn_feat.bmp

    Filesize

    4KB

    MD5

    02d95c7a26cd98a28096e93fea5e7391

    SHA1

    e440cefaaa72e8d729da2b8f8b1ed34bbb24d868

    SHA256

    38bee18aa19a4ab6eb1996b5d02fe2773680f83d82baf5ea056d81676a112edd

    SHA512

    bbadb1678f49ee3cb137aaa8d4307b8b429030bf588be2f8acbf2745bd3c5f29985f8c0707214c9329f9776b157992f4a6f7837b292d85b5be8d21c963b65fc6

  • \Users\Admin\AppData\Local\Temp\nst8E9A.tmp\InstGameInfoHelper.exe

    Filesize

    99KB

    MD5

    3d3d2bf9c42dbdf97247775c00f22190

    SHA1

    7a046170aaeb5e1a29d8c8cd7c32225f49237aa1

    SHA256

    59f09ba2c79a209008e76d0478bb691a9fdb2180d84318d9fc73b10401aa853a

    SHA512

    6e66c4ff467e286cd5dc1d4ccd412fec32cfd01514db6c339fd275eaab5f3b549e223e9330bc61ff19048df70b81b66dfcc78ac351aa2c5ff45cf8d197140466

  • \Users\Admin\AppData\Local\Temp\nst8E9A.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • \Users\Admin\AppData\Local\Temp\nst8E9A.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    acc2b699edfea5bf5aae45aba3a41e96

    SHA1

    d2accf4d494e43ceb2cff69abe4dd17147d29cc2

    SHA256

    168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

    SHA512

    e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe