Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 00:27

General

  • Target

    b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe

  • Size

    55KB

  • MD5

    b9a81478c33603bd3b8154ace1dec634

  • SHA1

    3a1409a7ceca2c69fd7a356728d10817ed23245f

  • SHA256

    b12f2000d3f1dfaa1f0372ab36ac1edf7743fe879c82f9009f5821225ee4897d

  • SHA512

    8b7d9bae301cce42b34cdfc677934b43c6f93717b3a6770d4a07bc9d2bc7e775f1bf2cfe78e1d3b36bef05690fb35039da63312210ca24e4d96a5842fd6843b0

  • SSDEEP

    768:Wc648rcDTCuajJ366d1S+lQFvv1YoOMNgbZpuNMrY7JsaeIwDJ8UJJk:WHuajJ366fcYoEtObeaIU

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Windows\w32_sysbm.bat" "
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2464
      • C:\Users\Admin\AppData\Local\Temp\B9A814~1.EXE
        C:\Users\Admin\AppData\Local\Temp\B9A814~1.EXE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Windows\MSCONFIG.exe
          "C:\Windows\MSCONFIG.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Windows\MSCONFIG.exe
            "C:\Windows\MSCONFIG.exe" stm
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2820
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 160
              6⤵
              • Program crash
              PID:2968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\w32_sysbm.bat

    Filesize

    2KB

    MD5

    fb2c65a9bf6dfc2255229aa5aa2e8995

    SHA1

    11d09bff6fba5537e7e7fb575a33544aadfa2cb8

    SHA256

    2ca7d85d41ae077a36533c0498c9a7a167c5bba5f167bb95d847803e2ad0efd7

    SHA512

    237d63684d08709911b64b20cffb38cd56c7c7c14fc497341b96fe9e647ffdf9d1124a78f2f3423dd4ec5b8adf8b40240fc65b2397efafde79333777724515b0

  • C:\Windows\w32_systm.exe

    Filesize

    52KB

    MD5

    b010589209f3ac3e9f907ae492cd4974

    SHA1

    804ddd8c7a940b602b9b616ee85e0796c4cbb098

    SHA256

    a94cbb3cf46ed985a6de6c5705b9dd8365bd1969bc8c8605617d38ccdfe56c94

    SHA512

    9b011437889fd6c489d62ae0483eca56646b112cf86232294ed9f5bf90910b47dc1efe5fb7867c7ddaa53820bb194d47a61faf89f1e69fad4d576da944a613b6

  • memory/2112-33-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2696-30-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2820-34-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/3004-0-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/3004-10-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB