Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 17:02

General

  • Target

    d26b987bace8107b211f439082935784_JaffaCakes118.exe

  • Size

    301KB

  • MD5

    d26b987bace8107b211f439082935784

  • SHA1

    47a37aa69cc416df4506588b83c5417bbb81b4ce

  • SHA256

    9d118e4f421dec8a5f37d1c995909da8695eaaf7bd506a9b1d1a6ae0c9a8cd62

  • SHA512

    40c9f310843d446c2abab649e0d935109be03e310f88c369a5fa7122a875c281f49e5bc4d37b744d70207df120dab11c2e69de9e9407e556d0874e8c69ba5d94

  • SSDEEP

    6144:nJEYERqaQiEYixXAkmOgoUpMEEdlntRb5A+na4S34EQwZ:J5+qntJxjfg5mxdltZ5A+na4iQwZ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d26b987bace8107b211f439082935784_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d26b987bace8107b211f439082935784_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\system32\Deleteme.bat
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2720
  • C:\Windows\SysWOW64\svohst.exe
    C:\Windows\SysWOW64\svohst.exe -NetSata
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Deleteme.bat

    Filesize

    212B

    MD5

    138cffe0bde4f2eee14d23b13599eb0b

    SHA1

    5dcf208ba4c490368ccf59655e476e0e7548109d

    SHA256

    d359045908baf7db3ab6dc2c43864229cb9d529efd2b36f30af2f32eac4d7855

    SHA512

    572ad10a44cd0c8c4443d8bd197febb937b37a585fe3855a3a1204f53bb0b71dc87bb0a96220d4214113650417348cae189c964ccfbe7eade02103fed4dd5e88

  • C:\Windows\SysWOW64\svohst.exe

    Filesize

    301KB

    MD5

    d26b987bace8107b211f439082935784

    SHA1

    47a37aa69cc416df4506588b83c5417bbb81b4ce

    SHA256

    9d118e4f421dec8a5f37d1c995909da8695eaaf7bd506a9b1d1a6ae0c9a8cd62

    SHA512

    40c9f310843d446c2abab649e0d935109be03e310f88c369a5fa7122a875c281f49e5bc4d37b744d70207df120dab11c2e69de9e9407e556d0874e8c69ba5d94

  • memory/2236-0-0x0000000000400000-0x000000000048006A-memory.dmp

    Filesize

    512KB

  • memory/2236-1-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2236-6-0x0000000000400000-0x000000000048006A-memory.dmp

    Filesize

    512KB

  • memory/2656-5-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2656-7-0x0000000000400000-0x000000000048006A-memory.dmp

    Filesize

    512KB