Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    116s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    31/08/2024, 23:57

General

  • Target

    cdd64f72f696856048da1d7251028dd4_JaffaCakes118.exe

  • Size

    322KB

  • MD5

    cdd64f72f696856048da1d7251028dd4

  • SHA1

    5318957551d6d2f826207fb7baef6e8c26684b16

  • SHA256

    b66b36c9fc88191bd596a59b83f68d2e2e39f0816edbe1977aa9e65fdacb72cb

  • SHA512

    7c6d4ca09b1d2b52d6db5a9fc3f706a5fea9ec6ede2d44583c2d67dca22766e45606e61965b16c2d7731cd0b810ae3a24f754758b440b9427d39c71fd7d18e5a

  • SSDEEP

    6144:QrV49uEo2S1YnQmCX492DkwNP3qpYFkKQdF8lgywXW/XK11AVBZ5jhqUnm8xcY:QrVQu6/eIo4qQdF8lEeXK11AZDqUmpY

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cdd64f72f696856048da1d7251028dd4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cdd64f72f696856048da1d7251028dd4_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2116

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Tsu6321B6F0.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • \Users\Admin\AppData\Local\Temp\{EA2171D1-4C30-4BFE-A915-041231C25327}\Custom.dll

    Filesize

    91KB

    MD5

    0842e2723fff1f80955c9dbd38019c75

    SHA1

    bea88c3fe74817b048951bd218e70d9dead617d9

    SHA256

    d71cea96d49b48f8702337d01681b2f144aca8acb56a699b9599106c11cc7458

    SHA512

    28acff8e01224291aa67f57b2d514db84a79fc2cf7ed28ed2e2cecbdf070fb3b1cf52e295a9412641422338f78d86fc6ea21d835a8de21565a8f53d24c604b02

  • \Users\Admin\AppData\Local\Temp\{EA2171D1-4C30-4BFE-A915-041231C25327}\_Setup.dll

    Filesize

    174KB

    MD5

    efbce92b48500e40573afc22277768ef

    SHA1

    0e6deed707b03d9f16bfb31554a1eded2e8408cf

    SHA256

    36223baec8556ec3ec139811cda245b4fb20d13999932e9089ff0c505ae21433

    SHA512

    db5469ee310c906e970d0dae01373abe1f824224345f8cf79eedfd8d79e9ed1e5e8727b63f44b75a8fce6fbe43cffee1f8877703a5e5cab25f7d093d0a505bd7