Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/09/2024, 10:00

General

  • Target

    cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe

  • Size

    37KB

  • MD5

    cf4884c260d6dba1b262b2305662593c

  • SHA1

    c971bc4645d82caebc10b4a7ef5f9676ba7cf63c

  • SHA256

    af3bf898da5864f374d850aef31b79987b3cf53f8e2705dad7e05dfefaeb787a

  • SHA512

    3a6fbe2a8f67164e7bea045511c0eb600b77f0a7b7e2f38a2df862ae4a4485a72d3be643aa35c4e99afec4f16e35dc3382ef6829bac86a4e59335f8cfc509d4d

  • SSDEEP

    768:edIZ/alwuAknNWuCMQpb0ruFm1YqTrmHwbLyMyw:edILlknNU4rOobbLynw

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1032
        • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
          "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2228
          • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
            "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

    Filesize

    37KB

    MD5

    ab646abfd145424bbd739bda12562e52

    SHA1

    0b0c38ddd0b786aa53abcb5df7c5cb7e39bb2b6d

    SHA256

    f932d46ed959d2e3a61b99f95ed6d535b3cc2dd5e94618c68312a921f545b242

    SHA512

    0c61eeb47bc81783a5239d1fc66211bb6a1733452236fdcfe08176b7da9465d05e5645e67162a0cf91f8b9b623e99bc8850b2c3012f8c581da6ce3d74ff14b47

  • memory/2228-42-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2228-43-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2480-0-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2480-8-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2480-10-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2480-6-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2480-4-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2480-2-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2480-12-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2480-39-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2480-40-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB