Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

b694031249...18.exe

windows7-x64

7

b694031249...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 05:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b694031249dc4586f2fafe98e4826a96_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    b694031249dc4586f2fafe98e4826a96

  • SHA1

    bd963a178fff7f2c5d88154832b87e4f581d013a

  • SHA256

    1fdd880d4a794918cb92d57809158937434b684df72e85245411154920507c33

  • SHA512

    136a3d579b79bbed03b96fdd6aca26e2626b220b1befa16f6ba6ba1d2f1b393774bd94dcdeb2d4649acb14eed1abaa46ee31fd2ba70202d7d14b573b8ff886e6

  • SSDEEP

    24576:AbfU+dsaEISnqlYBIlNsoH6ctU1fFnJZ+rzpD2:9ElEISuYu6oH6XR3eti

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b694031249dc4586f2fafe98e4826a96_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b694031249dc4586f2fafe98e4826a96_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Users\Admin\AppData\Local\Temp\b694031249dc4586f2fafe98e4826a96_JaffaCakes118-0BAC.exe
      "C:\Users\Admin\AppData\Local\Temp\b694031249dc4586f2fafe98e4826a96_JaffaCakes118-0BAC.exe" "C:\Users\Admin\AppData\Local\Temp\b694031249dc4586f2fafe98e4826a96_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\DBE2DF42\_Setup.dll
    Filesize

    620KB

    MD5

    c599c4840ec4c93e225e34c0126e825b

    SHA1

    bc8131cf6830a41d86263cafc7e787a66c947664

    SHA256

    58eb44fcd0b1081cf6f0ebee6b7c3d72896cf327665a94c0ee2e0f140a567a93

    SHA512

    7be6d2f093cafb2cb1565df25152d8646a2e8b86e4c8041a4ed3263b6304edfbc030821f42eb601a6086ae45cd63a101a4bea33eaff7c1de4d801b6a054f8582

    Download Submit

  • \Users\Admin\AppData\Local\Temp\DBE2DF42\_Setupx.dll
    Filesize

    412KB

    MD5

    7858a269c85d32ad22c33a0a6045411f

    SHA1

    b0acfcfa4b228aa6d45dc82342b1c22c3384015f

    SHA256

    a142ca5c960833012529f6cded0e776a3de8f11048359683dd7ab3ea7248a291

    SHA512

    048104cf8c3cd0f46b7aba8afc5df5e18f0674495294a0c579f6e4c3d27a21919f4844a6cdb89808aa83b38104135926b7b337cc2277691d896e025a6d0b001e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\b694031249dc4586f2fafe98e4826a96_JaffaCakes118-0BAC.exe
    Filesize

    222KB

    MD5

    5a8222c703b4a34f2227a652a49a2827

    SHA1

    ba8b1c8f341219d608a0a5a2a2c8d63c19697d05

    SHA256

    17936188efac05a0ef9fd87a79b268445ce307dd37a6f9206d116f195ab049c9

    SHA512

    7b1c200cf96ebb5b660fb11a85e3daf908a6e4d984c90207b5afa2444703fc784897160cf05a4bc592ecd908bf09f8dbd9195a4c0c07f1caef04bbd7c6624d9d

    Download Submit