Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2024, 17:41

General

  • Target

    d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe

  • Size

    39KB

  • MD5

    d6cf111bfb733f325666e8ccee041c7a

  • SHA1

    62a2655d151418a7f42e8990d0d92d4e0b68c5b7

  • SHA256

    e6b210664b8ccf719cd29ef0903fa5a4b8ee8f6069ab9a737fd25a2e0e8ee02a

  • SHA512

    385bb1db7e8713dbeba23accc714dc5575d2210fd5f73bf7e46bae19ac39438d8873d3f628e6299e99b758eaa36209d3fa29abdef81787fdfb6d6c8212f0b106

  • SSDEEP

    768:aT4wO+IkS0JAVnVibDMPbDLxdGRbn0/bwy/851xa1VNz4Z/Dft:mOXnVTjV5E521V6Z/x

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in System32 directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Windows\SysWOW64\virtscrl.exe
      "C:\Windows\system32\virtscrl.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2072
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /C del C:\Windows\SysWOW64\virtscrl.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2496
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\D6CF11~1.EXE > nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\virtscrl.exe

    Filesize

    39KB

    MD5

    d6cf111bfb733f325666e8ccee041c7a

    SHA1

    62a2655d151418a7f42e8990d0d92d4e0b68c5b7

    SHA256

    e6b210664b8ccf719cd29ef0903fa5a4b8ee8f6069ab9a737fd25a2e0e8ee02a

    SHA512

    385bb1db7e8713dbeba23accc714dc5575d2210fd5f73bf7e46bae19ac39438d8873d3f628e6299e99b758eaa36209d3fa29abdef81787fdfb6d6c8212f0b106

  • memory/2068-0-0x0000000000410000-0x00000000004BC000-memory.dmp

    Filesize

    688KB

  • memory/2072-10-0x0000000000480000-0x000000000052C000-memory.dmp

    Filesize

    688KB