Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    12/09/2024, 11:08

General

  • Target

    dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe

  • Size

    168KB

  • MD5

    dc3972c33695c275ef2d46e8ca6bac6b

  • SHA1

    d21fd1ccd03d32ea935ff46e6ec6c02bd2af3006

  • SHA256

    b57f37c359c50c19f8d29999a989f9cca27a5e4c8cbd646722391813ded5d87e

  • SHA512

    cc3211f0a8549624bead68b741896878d4d257a9057c3674364feed58d56c42e9259bc962f3b94affa9ac96f11aee7932e9e1e1001b9d7249849bf03d91acecd

  • SSDEEP

    3072:H1N1vsLAEKLHyy4xZttFXmFuBwEdy1N5ie7MVoMJVoJsevSTEkLdkJZdIGdYOMD:1sLAEaHyygZJlBNyjBMqMJB0SQ4kJZd6

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Unexpected DNS network traffic destination 4 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:332
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
      PID:844
      • C:\Windows\system32\wbem\WMIADAP.EXE
        wmiadap.exe /F /T /R
        2⤵
          PID:624
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1200
          • C:\Users\Admin\AppData\Local\Temp\dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe"
            2⤵
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2740
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe"
              3⤵
              • Deletes itself
              • System Location Discovery: System Language Discovery
              PID:2304

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\system32\consrv.dll

          Filesize

          52KB

          MD5

          6bf2039986af96d98e08824ac6c383fd

          SHA1

          0bb6384656a96943cb427baa92446f987219a02e

          SHA256

          a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

          SHA512

          fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

        • \??\globalroot\systemroot\assembly\temp\@

          Filesize

          2KB

          MD5

          60a7af3867a098bb70e2d7c367b30760

          SHA1

          953d7fb9cec5b77a618d1179039849a2eee7767d

          SHA256

          503116b6b5895e0560529f4a0a1896bfd3ce89a8a04a461fd2d8f2a141d487a8

          SHA512

          6c607cc99eab5d22acf37b5fcc25804e2de84ea4b4efdf49659fbfc33a1aba73c0a98fbd18f43f2d343a24cfb48c9c637b07e007fa6798bc042d4616529a7032

        • memory/332-18-0x0000000000C20000-0x0000000000C21000-memory.dmp

          Filesize

          4KB

        • memory/332-30-0x0000000000C90000-0x0000000000CA1000-memory.dmp

          Filesize

          68KB

        • memory/332-21-0x0000000000C90000-0x0000000000CA1000-memory.dmp

          Filesize

          68KB

        • memory/332-20-0x0000000000C90000-0x0000000000CA1000-memory.dmp

          Filesize

          68KB

        • memory/844-32-0x0000000000560000-0x000000000056B000-memory.dmp

          Filesize

          44KB

        • memory/844-41-0x0000000000550000-0x0000000000558000-memory.dmp

          Filesize

          32KB

        • memory/844-40-0x0000000000560000-0x000000000056B000-memory.dmp

          Filesize

          44KB

        • memory/844-45-0x0000000000550000-0x0000000000558000-memory.dmp

          Filesize

          32KB

        • memory/844-42-0x0000000000570000-0x000000000057B000-memory.dmp

          Filesize

          44KB

        • memory/844-46-0x0000000000570000-0x000000000057B000-memory.dmp

          Filesize

          44KB

        • memory/844-37-0x0000000000560000-0x000000000056B000-memory.dmp

          Filesize

          44KB

        • memory/1200-13-0x0000000002DF0000-0x0000000002DF6000-memory.dmp

          Filesize

          24KB

        • memory/1200-5-0x0000000002A70000-0x0000000002A72000-memory.dmp

          Filesize

          8KB

        • memory/1200-9-0x0000000002DF0000-0x0000000002DF6000-memory.dmp

          Filesize

          24KB

        • memory/1200-4-0x0000000002DF0000-0x0000000002DF6000-memory.dmp

          Filesize

          24KB

        • memory/2740-29-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/2740-25-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/2740-24-0x0000000000401000-0x0000000000405000-memory.dmp

          Filesize

          16KB

        • memory/2740-0-0x0000000000401000-0x0000000000405000-memory.dmp

          Filesize

          16KB

        • memory/2740-3-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/2740-2-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/2740-1-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB