Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 21:35

General

  • Target

    bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe

  • Size

    784KB

  • MD5

    bd3e3d2727ba5a17d14498b17bb4378a

  • SHA1

    fb34955e3bf2044a9ebe07d46262e0d4f2af8235

  • SHA256

    cb2946d049291d2da4abf3d6b98307c541b9856a5cc045d4bc4b5980e80d7baf

  • SHA512

    93ab18345e309bb092deab3f2d41b3b40e7305dcb9a0481d2e7eb0edd370fe0383e37279ca7f56f074bea70cff5c39d4f4804e308ffa740d01192a8905b4f640

  • SSDEEP

    24576:gk3kfzoHCxAasiQ04qMbiSjqPtJO2J+L:gk3k7oGVWjbiSe+2YL

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 7 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of UnmapMainImage
      PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe

    Filesize

    784KB

    MD5

    6d2c6e24667ebd4d3f84a9202efae9b4

    SHA1

    afc6108c8a67e96bbe192dedc4cea160237252bd

    SHA256

    6bca7ec2bd6b562a1ba4f221713ac687853fe1c7d73dd816ee8743bb148140d5

    SHA512

    7df1e1ca05e1e438b7d7f1b3375e6ed250dbf173085f7fa5a44a8f39f3754bb217fb0a025883877c662952996c0be4c952ce68c29a935453faf62d523fe22e88

  • memory/2680-27-0x0000000003060000-0x00000000031F3000-memory.dmp

    Filesize

    1.6MB

  • memory/2680-17-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/2680-18-0x0000000001720000-0x00000000017E4000-memory.dmp

    Filesize

    784KB

  • memory/2680-24-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/2680-19-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2680-34-0x00000000005A0000-0x000000000071F000-memory.dmp

    Filesize

    1.5MB

  • memory/2680-35-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/3016-2-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/3016-1-0x0000000001720000-0x00000000017E4000-memory.dmp

    Filesize

    784KB

  • memory/3016-14-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/3016-15-0x0000000003290000-0x00000000035A2000-memory.dmp

    Filesize

    3.1MB

  • memory/3016-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB