Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2024, 11:48

General

  • Target

    d63fb5e1aa0c7de50bca1afc0ce68187_JaffaCakes118.exe

  • Size

    226KB

  • MD5

    d63fb5e1aa0c7de50bca1afc0ce68187

  • SHA1

    b161815d0834fa5cd56568baf70a4c60e2200e01

  • SHA256

    40e540a293ca232c6a4be4de16ae4a40256193864b9fa5aadd9d72150309509a

  • SHA512

    0d8644f175084cad6447ad0d6624349753b704666e4525830a41118e3b1e50c9f1d860d6669fb0e40d71ba9c413638fb14be27f765ce0a3b88b5d7e0e92caf05

  • SSDEEP

    3072:yweqOYEUXPnGuReQQBfi4oQLNuIuTS4GCqXmy6bUn59Fd:PEUXV7Qi+uIuTSsqXmy6I59

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d63fb5e1aa0c7de50bca1afc0ce68187_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d63fb5e1aa0c7de50bca1afc0ce68187_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    PID:1568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab35D5.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar3674.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\nsz17B7.tmp\System.dll

    Filesize

    11KB

    MD5

    bf712f32249029466fa86756f5546950

    SHA1

    75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

    SHA256

    7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

    SHA512

    13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

  • \Users\Admin\AppData\Local\Temp\nsz17B7.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    c7ce0e47c83525983fd2c4c9566b4aad

    SHA1

    38b7ad7bb32ffae35540fce373b8a671878dc54e

    SHA256

    6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae

    SHA512

    ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e

  • \Users\Admin\AppData\Local\Temp\nsz17B7.tmp\inetcw.dll

    Filesize

    22KB

    MD5

    5b6759d98b6ed62f6f8d501fba6505fa

    SHA1

    f3a9d9e252faba24ff14a8d80e4786d66b20a717

    SHA256

    c97c576acddaa932188ff07f31999ba663b838d77a38eab5aed25553417f613f

    SHA512

    e2bafcdaff8af11efbc90d18fba30762f6054ed08836c4174bd054f5575c7252c8839077d025b3e0fbcc9a2237f47d33b770e0304d43a2616700b78a8dfde310