Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 04:42

General

  • Target

    b66223b35fffce07397a3ca1e3a49082_JaffaCakes118.exe

  • Size

    562KB

  • MD5

    b66223b35fffce07397a3ca1e3a49082

  • SHA1

    f3ba995bdb2daa3c9083711a025452ade7946a92

  • SHA256

    8b5bde3de830de9ed962e08bc7017eca6e597048bcf530c3c92778b822a18a7e

  • SHA512

    5817feb289df23d91f9d2d519d715c833063571ad8bd7128ee85b29f0f6f3378189a17bd31155d4f91ee63c95dfeb7ad818ed0d8160cfded1e2a650fefefb547

  • SSDEEP

    12288:jdD7F1UxXDhrloUfzTAvZYs9mrnGbkOASm7C+5GWVJ3z:jZ7jUxT0STy9mrnGk1GfWHz

Malware Config

Signatures

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Themida packer 16 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b66223b35fffce07397a3ca1e3a49082_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b66223b35fffce07397a3ca1e3a49082_JaffaCakes118.exe"
    1⤵
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:3044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3044-0-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-1-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-2-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-3-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-4-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-5-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-6-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-7-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-8-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-9-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-10-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-11-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-12-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-13-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-14-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-15-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB