Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 19:27

General

  • Target

    bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe

  • Size

    84KB

  • MD5

    bce1c4eab4cc9dc82cce0f360ce22edb

  • SHA1

    15ea0e6a88f2c1979dd3d6f135f4591031baf639

  • SHA256

    f2910adb30a6f61cbc56141f8625c1ec46ba631e6856616f716ca0e390beb824

  • SHA512

    73f4b7a1bc8e3153baa10a60cdbd3231f977c082f000a980f73c9d2334c96882b73c238eea8c84a35fc570ab372c70db6d0a5017c7c36b8b2c1616db2ed5e80b

  • SSDEEP

    1536:9uJAbqy3Zoz21uNfuiLOeWGNOJ6IDo5gkR4GxoRZsQvo2t:9AtypoU2LORGNOhKgkRP2t

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\mstsc.exe
      C:\Users\Admin\AppData\Local\Temp\mstsc.exe /waitservice
      2⤵
      • Executes dropped EXE
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\mstsc.exe

    Filesize

    84KB

    MD5

    bce1c4eab4cc9dc82cce0f360ce22edb

    SHA1

    15ea0e6a88f2c1979dd3d6f135f4591031baf639

    SHA256

    f2910adb30a6f61cbc56141f8625c1ec46ba631e6856616f716ca0e390beb824

    SHA512

    73f4b7a1bc8e3153baa10a60cdbd3231f977c082f000a980f73c9d2334c96882b73c238eea8c84a35fc570ab372c70db6d0a5017c7c36b8b2c1616db2ed5e80b