Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    28/08/2024, 21:05

General

  • Target

    c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe

  • Size

    3.5MB

  • MD5

    c7a676e984bf992c01ad18fb6ed7b289

  • SHA1

    af59d490c8247d0bcc6892d424318f2e787ef73f

  • SHA256

    f63c4e0a8946c15ba8d8343c0265cc483ffe9cdb0e62a996a1f995e57e4f9f52

  • SHA512

    c33032037698151ced330ba55c0a449d7b492bed8d853a457a01c746c12404e2b416ba3c737d9f2875d187b2e158ea45eb84c9d1d79a8a76e666934581713c12

  • SSDEEP

    49152:0a1ISQus8/2Ge/5mMk1HvWpcnscVyCDxl4KZKWCbquSVex1yrZO70r:/1ISQusLGKmMaHgcn+gxPKWCbMs1Gt

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Documents and Settings\tazebama.dl_
      "C:\Documents and Settings\tazebama.dl_"
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\autorun.inf

    Filesize

    126B

    MD5

    163e20cbccefcdd42f46e43a94173c46

    SHA1

    4c7b5048e8608e2a75799e00ecf1bbb4773279ae

    SHA256

    7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

    SHA512

    e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

  • C:\zPharaoh.exe

    Filesize

    157KB

    MD5

    91ad3f73942ec729b2bd0ec957065c71

    SHA1

    26aa7edc43424bb11c439b4879ada78d616b261a

    SHA256

    4af21f4995d475c85028cd76585656d3e17a295326b496fd64d17f85b9aa0bd8

    SHA512

    a8df716d5572a7d79628d6b8088da79437816f37d790dacea6d4c7717aa447ecacc39be9e9b03d6663882b03da0972238ce5edc93e7f4d1505287a8f859908b9

  • F:\$RECYCLE.BIN\S-1-5-21-2257386474-3982792636-3902186748-1000\RCX70DE.tmp

    Filesize

    69KB

    MD5

    8ba404e90194c38541e324657e72f74c

    SHA1

    ad9fda28f95b7747579a7fbb8a18e1d1e6311a49

    SHA256

    8145e4c62390f9c55343cc6dadb790dc2cb9463c4f578fa57bf43f12c4720340

    SHA512

    1f594ebb6b970c9cb86b97d642351106a52db407c6e90db7391b50e97a1136e5ba13aeec66c9b985192c377d8c5c70d3746a00f37bcc83855fea316cf8d82362

  • F:\$RECYCLE.BIN\S-1-5-21-2257386474-3982792636-3902186748-1000\WinrRarSerialInstall.exe

    Filesize

    77KB

    MD5

    20d43f8bbb2169613263579815f2999e

    SHA1

    0a8d9a8b166cb0b1f461124cd2f44487ea990ba0

    SHA256

    b17f2664d0fdb735828d542ea27073740d961f6f697cc9953875588039a0ad3a

    SHA512

    c21e3f582355f6c5150c0993d5f30bf503128b8ac68e609d4674528b7dfba365fda00deb860cc6c03b7846763fdcc963c84945a3440f2eb25b68d3388ceec35f

  • F:\zPharaoh.exe

    Filesize

    157KB

    MD5

    c8fb29b7a331b6c66f995bfe95ef59bd

    SHA1

    127bd2086f648f53a9a926171bcf106f2ac25cce

    SHA256

    8426834717872b0f5344f4f895a26880c69d260a7057de91e0334c0b05aae725

    SHA512

    2e68ef1170f504451d2138228535a87102d417f59d398d1c26cce2962ae5e195133adf6ff1edfdf12b9f07c7dee58df5c47cb6873e52896fe98c62675c8ea136

  • \Users\tazebama.dl_

    Filesize

    157KB

    MD5

    4c5406f905ce7f5662a2b698188ee56a

    SHA1

    3409d80da034c3efa426692f7ee7d7b7f7c06955

    SHA256

    5bce523ac1ba8f94ef2a7f13409b3b5962eddaf9d5a4778b9f6f5e7829dd11a6

    SHA512

    06ea515c45e5400bb064c0b1cd4899abe3dcdeca5e8d4755287daab8a0e2374f5bad53d6e6ae0eeb57c691620e01e4e541e7cff3c25274a465c40ef17db2d336

  • \Users\tazebama.dll

    Filesize

    32KB

    MD5

    b6a03576e595afacb37ada2f1d5a0529

    SHA1

    d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

    SHA256

    1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

    SHA512

    181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

  • memory/2228-13-0x000000000115E000-0x000000000116A000-memory.dmp

    Filesize

    48KB

  • memory/2228-7-0x00000000001E0000-0x00000000001F8000-memory.dmp

    Filesize

    96KB

  • memory/2228-0-0x0000000001000000-0x000000000136B000-memory.dmp

    Filesize

    3.4MB

  • memory/2228-78-0x0000000001000000-0x000000000136B000-memory.dmp

    Filesize

    3.4MB

  • memory/2228-79-0x0000000001000000-0x000000000136B000-memory.dmp

    Filesize

    3.4MB

  • memory/2740-77-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB