Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
12/09/2024, 06:06
General
-
Target
dbf373bb2c8f589348c81fb228264e6b_JaffaCakes118.exe
-
Size
240KB
-
MD5
dbf373bb2c8f589348c81fb228264e6b
-
SHA1
5a3a270281888b37e2fc9efd88a5dc7af4f0c860
-
SHA256
f43de2802350eb6b1574084937828090ffa2f60931a626e70b661a36052cf0b1
-
SHA512
fba34b041f6e559dcd760d8c24c128eff1d458e90713bb96e8a812bf07f6a387ffcd1b2a3cc446059740bcd1420d2aa0b13dbb13a097a1f3ffb1c130b5fcb65c
-
SSDEEP
6144:7HRYTjOZt8zrgH76LYNyHyMhVKRzbl875i+JMN45PHK:LS+2gO0cHyMsp+zMoi
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
-
C:\Users\Admin\AppData\Local\Temp\dbf373bb2c8f589348c81fb228264e6b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dbf373bb2c8f589348c81fb228264e6b_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\d2f57668\X*0*db*6869964f*69.64.52.10:533⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
Filesize
29KB
MD51149c1bd71248a9d170e4568fb08df30
SHA16f77f183d65709901f476c5d6eebaed060a495f9
SHA256c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1
SHA5129e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459
-
Filesize
2KB
MD518ce8fa52b819eb6b564db4784694493
SHA15cab91c8bedbb1d6507cb53ce472eb1b076784da
SHA256868767eedebb7b66e0063472ea2220b5f56088195eddaffe298790607f5aeb55
SHA512799cd06eb551794ff256750442d18d534493172df64f062ac8e8251728000e236c46d11ee57dfe8b52591eab46bb611385ea54b28cd31b90221b00872084cf35
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
32KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
8KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
216KB
-
Filesize
344KB