Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2024, 11:05

General

  • Target

    d43701b37ba732f2ff5ed08383661328_JaffaCakes118.exe

  • Size

    312KB

  • MD5

    d43701b37ba732f2ff5ed08383661328

  • SHA1

    981263e5607f5e19feca498267cfbd8356d12433

  • SHA256

    efe89e4ae67a1a92284e29fcccf29b4c58aa947a9c38005410a9fcaafa5e1a63

  • SHA512

    8dc2e6681bcd1de5f06964f080f4812e57126f0dfdaf13941a25eb56a60ef66ef20a8e80dbcd152e120c13e304251b7e3901238265d68c820b45b0c2bbb23c3d

  • SSDEEP

    6144:zyOuBlo8dCyd1dUhAE74jvaG66xegV+/mJC63WIOP+tN1JB5fnKf:zsdjaUq6QgV+OvSPG175fKf

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1112
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1156
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1192
          • C:\Users\Admin\AppData\Local\Temp\d43701b37ba732f2ff5ed08383661328_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\d43701b37ba732f2ff5ed08383661328_JaffaCakes118.exe"
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of UnmapMainImage
            • Suspicious use of WriteProcessMemory
            PID:3052
            • C:\Users\Admin\AppData\Roaming\Sago\kiod.exe
              "C:\Users\Admin\AppData\Roaming\Sago\kiod.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of UnmapMainImage
              • Suspicious use of WriteProcessMemory
              PID:2436
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpb369c37d.bat"
              3⤵
              • Deletes itself
              • System Location Discovery: System Language Discovery
              PID:2012
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1600
          • C:\Users\Admin\AppData\Local\Temp\4183940270\zmstage.exe
            C:\Users\Admin\AppData\Local\Temp\4183940270\zmstage.exe
            1⤵
              PID:2296

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpb369c37d.bat

              Filesize

              271B

              MD5

              8edd545fc036a90b9631bab7f9ef1716

              SHA1

              12500228ae84f3c24b6a3a12fb17ff16607be39f

              SHA256

              e236964c3b0785a95453d25c25fcf7fbe7c181b6e91262783a6265f3cd14e9aa

              SHA512

              b6536e8a17782e28ecfb61ee01a3db47016d3abff681fc46ac06b89736cbab8dc85f31715bd607f8c4ceb2722c010a19cf8af35c9f54b981db630df955aafbb4

            • \Users\Admin\AppData\Roaming\Sago\kiod.exe

              Filesize

              312KB

              MD5

              beca8f129ec8467d17c72dbb9665878d

              SHA1

              7f2819fcaa0d06f1768bdfcbbbee2145dbf0fe8f

              SHA256

              e7a60dcffb640a96f35960396e7746191864c7465a17d305524c9371cf75dde6

              SHA512

              f24ba93c58999d42506f7af06d084b10393a77837c7a57bd798ae0b7bf592d4ded2848bd540a7a4c57d194062724f8c2e53bfff7306607c1d6cc8a85c0545383

            • memory/1112-18-0x0000000000440000-0x0000000000484000-memory.dmp

              Filesize

              272KB

            • memory/1112-24-0x0000000000440000-0x0000000000484000-memory.dmp

              Filesize

              272KB

            • memory/1112-22-0x0000000000440000-0x0000000000484000-memory.dmp

              Filesize

              272KB

            • memory/1112-20-0x0000000000440000-0x0000000000484000-memory.dmp

              Filesize

              272KB

            • memory/1112-16-0x0000000000440000-0x0000000000484000-memory.dmp

              Filesize

              272KB

            • memory/1156-29-0x0000000001F90000-0x0000000001FD4000-memory.dmp

              Filesize

              272KB

            • memory/1156-27-0x0000000001F90000-0x0000000001FD4000-memory.dmp

              Filesize

              272KB

            • memory/1156-28-0x0000000001F90000-0x0000000001FD4000-memory.dmp

              Filesize

              272KB

            • memory/1156-30-0x0000000001F90000-0x0000000001FD4000-memory.dmp

              Filesize

              272KB

            • memory/1192-34-0x0000000002D70000-0x0000000002DB4000-memory.dmp

              Filesize

              272KB

            • memory/1192-32-0x0000000002D70000-0x0000000002DB4000-memory.dmp

              Filesize

              272KB

            • memory/1192-35-0x0000000002D70000-0x0000000002DB4000-memory.dmp

              Filesize

              272KB

            • memory/1192-33-0x0000000002D70000-0x0000000002DB4000-memory.dmp

              Filesize

              272KB

            • memory/1600-40-0x0000000001F30000-0x0000000001F74000-memory.dmp

              Filesize

              272KB

            • memory/1600-39-0x0000000001F30000-0x0000000001F74000-memory.dmp

              Filesize

              272KB

            • memory/1600-38-0x0000000001F30000-0x0000000001F74000-memory.dmp

              Filesize

              272KB

            • memory/1600-37-0x0000000001F30000-0x0000000001F74000-memory.dmp

              Filesize

              272KB

            • memory/2296-42-0x0000000000B10000-0x0000000000B54000-memory.dmp

              Filesize

              272KB

            • memory/2296-43-0x0000000000B10000-0x0000000000B54000-memory.dmp

              Filesize

              272KB

            • memory/2436-64-0x0000000000330000-0x0000000000374000-memory.dmp

              Filesize

              272KB

            • memory/2436-65-0x0000000000380000-0x00000000003D3000-memory.dmp

              Filesize

              332KB

            • memory/2436-68-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/2436-286-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/3052-69-0x0000000001E80000-0x0000000001EC4000-memory.dmp

              Filesize

              272KB

            • memory/3052-71-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-47-0x0000000001E80000-0x0000000001EC4000-memory.dmp

              Filesize

              272KB

            • memory/3052-46-0x0000000001E80000-0x0000000001EC4000-memory.dmp

              Filesize

              272KB

            • memory/3052-45-0x0000000001E80000-0x0000000001EC4000-memory.dmp

              Filesize

              272KB

            • memory/3052-49-0x0000000001E80000-0x0000000001EC4000-memory.dmp

              Filesize

              272KB

            • memory/3052-50-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-52-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-54-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-56-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-58-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-60-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-62-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-66-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-0-0x0000000000280000-0x00000000002C4000-memory.dmp

              Filesize

              272KB

            • memory/3052-48-0x0000000001E80000-0x0000000001EC4000-memory.dmp

              Filesize

              272KB

            • memory/3052-73-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-75-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-77-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-79-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-139-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-81-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/3052-70-0x0000000077D30000-0x0000000077D31000-memory.dmp

              Filesize

              4KB

            • memory/3052-4-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/3052-7-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/3052-3-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/3052-164-0x0000000001E80000-0x0000000001EC4000-memory.dmp

              Filesize

              272KB

            • memory/3052-163-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/3052-162-0x0000000000350000-0x00000000003A3000-memory.dmp

              Filesize

              332KB

            • memory/3052-2-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/3052-1-0x0000000000350000-0x00000000003A3000-memory.dmp

              Filesize

              332KB