Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    29/08/2024, 19:25

General

  • Target

    c97960cfb1a8ddca53f33a4c12ca9b2f_JaffaCakes118.exe

  • Size

    784KB

  • MD5

    c97960cfb1a8ddca53f33a4c12ca9b2f

  • SHA1

    095cfb8ac5f3f98f12e507cebc3179a80f9c470b

  • SHA256

    708545763a6f8f9f7f5724a83b27363951e9fecd7d5f81bc7644193b63676ce5

  • SHA512

    a3b5162874a1ade4df08f6517858455895c1939cca189b3961754bc831543512e4db16b75ecf1dd425cbaeee120fd821019cf6af6af338a55f98e4e635de82b2

  • SSDEEP

    12288:sobDXJmz3CAQLy7tq4v/GQej4nNTovQ0f0YKVjvvQW+kPIOFCgYMJI+:sobD5s3Cu7CBjw9oVfG6LyrFrJ

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 9 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c97960cfb1a8ddca53f33a4c12ca9b2f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c97960cfb1a8ddca53f33a4c12ca9b2f_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2704
    • C:\Users\Admin\AppData\Local\Temp\c97960cfb1a8ddca53f33a4c12ca9b2f_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\c97960cfb1a8ddca53f33a4c12ca9b2f_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of UnmapMainImage
      PID:2840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\c97960cfb1a8ddca53f33a4c12ca9b2f_JaffaCakes118.exe

    Filesize

    784KB

    MD5

    f515810f6ea4d7bc0cdca8fab58b1c65

    SHA1

    6fb51fdc0e7615411a507dd38a7464f99aca5c11

    SHA256

    763ad469256c95de5725c13affc10dabb4a077f917968dbca4b09518588c6535

    SHA512

    dd089eef63aa5234670ad09f721359ca1f81c37ed5fd7a6ef2b9de6900553affd8ec6c06dc1cafce6da1130ec2448aefbce06acfc817083580e546532f15bdb9

  • memory/2704-16-0x0000000003260000-0x0000000003572000-memory.dmp

    Filesize

    3.1MB

  • memory/2704-2-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2704-1-0x0000000000120000-0x00000000001E4000-memory.dmp

    Filesize

    784KB

  • memory/2704-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/2704-14-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2704-36-0x0000000003260000-0x0000000003572000-memory.dmp

    Filesize

    3.1MB

  • memory/2840-17-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/2840-18-0x0000000000120000-0x00000000001E4000-memory.dmp

    Filesize

    784KB

  • memory/2840-19-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2840-35-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/2840-34-0x00000000005A0000-0x000000000071F000-memory.dmp

    Filesize

    1.5MB

  • memory/2840-24-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/2840-33-0x0000000003230000-0x00000000033C3000-memory.dmp

    Filesize

    1.6MB