Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 17:16 UTC

General

  • Target

    d271ecbfca9ac11db371d327b3097ee8_JaffaCakes118.exe

  • Size

    248KB

  • MD5

    d271ecbfca9ac11db371d327b3097ee8

  • SHA1

    b6e0f2a1b9959f780fb3d2b6da2129120208d812

  • SHA256

    b505f4b09cffc4f0b67fedf26314051eecc524c857b311cc2ad74be77244c996

  • SHA512

    58957e5b3f993a99f8f625731c0c9e6864907a49a946836edf79af67e82e1160f84e8f48a0dfdc803fd0cb9471f1672b29b9f319829b91e3b6353fa5d8bf127b

  • SSDEEP

    6144:v4yZXY+8OgkdrQ1owQ7tTgdkTbX1Gck7vG9a:v4yC+8OgAQ1owQ7SebXcckLv

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d271ecbfca9ac11db371d327b3097ee8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d271ecbfca9ac11db371d327b3097ee8_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
        PID:2820
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2784
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2148

    Network

    • flag-us
      DNS
      badoo.no-ip.info
      iexplore.exe
      Remote address:
      8.8.8.8:53
      Request
      badoo.no-ip.info
      IN A
      Response
    • 127.0.0.1:3070
      iexplore.exe
    • 127.0.0.1:3070
      iexplore.exe
    • 127.0.0.1:3070
      iexplore.exe
    • 127.0.0.1:3070
      iexplore.exe
    • 127.0.0.1:3070
      iexplore.exe
    • 127.0.0.1:3070
      iexplore.exe
    • 127.0.0.1:3070
      iexplore.exe
    • 127.0.0.1:3070
      iexplore.exe
    • 127.0.0.1:3070
      iexplore.exe
    • 127.0.0.1:3070
      iexplore.exe
    • 127.0.0.1:3070
      iexplore.exe
    • 8.8.8.8:53
      badoo.no-ip.info
      dns
      iexplore.exe
      62 B
      122 B
      1
      1

      DNS Request

      badoo.no-ip.info

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2708-0-0x0000000073C01000-0x0000000073C02000-memory.dmp

      Filesize

      4KB

    • memory/2708-1-0x0000000073C00000-0x00000000741AB000-memory.dmp

      Filesize

      5.7MB

    • memory/2708-2-0x0000000073C00000-0x00000000741AB000-memory.dmp

      Filesize

      5.7MB

    • memory/2708-25-0x0000000073C00000-0x00000000741AB000-memory.dmp

      Filesize

      5.7MB

    • memory/2784-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2784-13-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2784-24-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2784-22-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2784-21-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2784-17-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2784-15-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2784-23-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2784-9-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2784-7-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2784-11-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2784-5-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2784-34-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2784-28-0x0000000010410000-0x0000000010441000-memory.dmp

      Filesize

      196KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.