Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/09/2024, 03:08

General

  • Target

    d982a091df4135eba9e041d9e1efdfa1_JaffaCakes118.exe

  • Size

    888KB

  • MD5

    d982a091df4135eba9e041d9e1efdfa1

  • SHA1

    27688440f2c233db9f7f264fa79cbbd23a174594

  • SHA256

    0bc426cb64f61d248795cc0da8be978f95ace2941f73664b203cf61168c6c3d8

  • SHA512

    4822addce2e07cbb3a12ec4fef3f73907e6a8e963f18197308e3f6da83960fd12c223cd1936e9876da949286bc9d5a8761024396437b508ac9bc9b9ece325eb0

  • SSDEEP

    24576:nqzmyzmiYFKAXlgrFfVAuoP1E9ZQ+XdGfO7Z2X:qzqRw7loNGioVo

Score
10/10

Malware Config

Signatures

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • mimikatz is an open source tool to dump credentials on Windows 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d982a091df4135eba9e041d9e1efdfa1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d982a091df4135eba9e041d9e1efdfa1_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Users\Admin\AppData\Local\Temp\d982a091df4135eba9e041d9e1efdfa1_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\d982a091df4135eba9e041d9e1efdfa1_JaffaCakes118.exe"
      2⤵
        PID:2988

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2844-1-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

    • memory/2988-25-0x0000000000401000-0x000000000043E000-memory.dmp

      Filesize

      244KB

    • memory/2988-4-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB

    • memory/2988-6-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB

    • memory/2988-8-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB

    • memory/2988-11-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB

    • memory/2988-2-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB

    • memory/2988-23-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB

    • memory/2988-22-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB

    • memory/2988-20-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB

    • memory/2988-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2988-16-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB

    • memory/2988-14-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB

    • memory/2988-12-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB