Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1s
  • max time network
    1s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2024, 08:51

General

  • Target

    d3fa291174e309fa1ea320dc1c642d12_JaffaCakes118.exe

  • Size

    477KB

  • MD5

    d3fa291174e309fa1ea320dc1c642d12

  • SHA1

    6d499b7238e802949a3ebda53721d3ae41a68794

  • SHA256

    213b26ae2636e5fdfebcae7723fab4d523de2406155e198f299eb8edbfe58581

  • SHA512

    5b800301578a975635cd374b7d2fc89e887ff856291c3512e7c7e8536e0dafe65ee6293192b4cc9a5ed50de96b277f9de73c16e69d815f9d0b561357b1acd7e4

  • SSDEEP

    12288:FsvU983wtVMtIaMjY6r+kRkBb63vd1Mp8upU5ks4FW:FF2wsOt+w2Y1Mp8ul4

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3fa291174e309fa1ea320dc1c642d12_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d3fa291174e309fa1ea320dc1c642d12_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Users\Admin\T3K9ZAW7.exe
      T3K9ZAW7.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2764
    • C:\Users\Admin\wot.exe
      wot.exe
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of AdjustPrivilegeToken
      PID:2680
    • C:\Users\Admin\xot.exe
      xot.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\mspror.dll",Startup
        3⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2348
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del d3fa291174e309fa1ea320dc1c642d12_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\mspror.dll

    Filesize

    103KB

    MD5

    b830953856e06807f6419663f6d05cc6

    SHA1

    1985aa83dbcaad52a6098a7bffcd8688f0d203aa

    SHA256

    ed89baf97368e00ae45aa798fda02ed521557898bd6c9c50b2b98a035dceb81e

    SHA512

    6553f322de9e87e3bff14a08c500b69aa2ce3a0946e25bf9464c7d7dca22d96ef2da2fe00ed86e2d687a9f8f4345ab5189130a7c95606275df19d2f9169b354b

  • C:\Users\Admin\T3K9ZAW7.exe

    Filesize

    140KB

    MD5

    13af4de26b3ee9d02e8dd721f6b81fe9

    SHA1

    6036d52a71cc9a5f176db6d40cdea0e8d1b023ce

    SHA256

    10301813c139bbb2f2cbc5a47a8b78989c37cf56bfcdf8cbb2fd324057a799e3

    SHA512

    05c69348ac57578fdf81c035350ee6856ee17a72c1c1359013d5ec50430804c781753eb995870262157ba557c102285a4b012c2e53a73971213d9fdb269faa66

  • C:\Users\Admin\xot.exe

    Filesize

    103KB

    MD5

    b47a4d45ef404a997dcd2f98fe4a1420

    SHA1

    e55a876e4098a705be35e1a9c78c65a97ae5f27d

    SHA256

    9863f46ae1d3e2f835b713e2fb32c831e27941b4cdbb11663780e2101df6289b

    SHA512

    1f83decef10da3e7537dde84cebfd4ec2ca7dab05e3fb72237ad2d627f544d493d501822bf0927bc3cc061442cbe779cf054b87da1decc77a3b9eb6fa07ebd20

  • \Users\Admin\wot.exe

    Filesize

    175KB

    MD5

    c9b7e9a83250faf3135bb70343030c16

    SHA1

    f738cf9018d564ec802b684e38b54ecdf0a679f6

    SHA256

    26d3130abf8d1f0d234e7be1f28de877d7ae871ec96f179f9d49d8156c20c1ea

    SHA512

    2c574af59c9131a2917024f644176ca6311e6433be53d9602e4db873d01da16f9e1f4dc7952b9b667a4f8fac346037e30d5337db5cd895c13b51635c44a024c4

  • memory/2068-44-0x0000000010000000-0x000000001001D000-memory.dmp

    Filesize

    116KB

  • memory/2068-36-0x0000000000600000-0x0000000000640000-memory.dmp

    Filesize

    256KB

  • memory/2068-32-0x0000000010000000-0x000000001001D000-memory.dmp

    Filesize

    116KB

  • memory/2068-37-0x0000000000600000-0x0000000000640000-memory.dmp

    Filesize

    256KB

  • memory/2260-20-0x0000000000330000-0x0000000000387000-memory.dmp

    Filesize

    348KB

  • memory/2260-19-0x0000000000330000-0x0000000000387000-memory.dmp

    Filesize

    348KB

  • memory/2348-54-0x0000000010000000-0x000000001001D000-memory.dmp

    Filesize

    116KB

  • memory/2348-52-0x0000000000CF0000-0x0000000000D30000-memory.dmp

    Filesize

    256KB

  • memory/2348-51-0x0000000000CF0000-0x0000000000D30000-memory.dmp

    Filesize

    256KB

  • memory/2680-38-0x0000000000330000-0x0000000000387000-memory.dmp

    Filesize

    348KB

  • memory/2680-45-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2680-39-0x0000000000333000-0x0000000000334000-memory.dmp

    Filesize

    4KB

  • memory/2680-40-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2680-28-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2680-29-0x0000000000403000-0x0000000000404000-memory.dmp

    Filesize

    4KB

  • memory/2680-30-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB