Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 11:14

General

  • Target

    e011a235dc8fa9746a826a8958ffa919_JaffaCakes118.exe

  • Size

    296KB

  • MD5

    e011a235dc8fa9746a826a8958ffa919

  • SHA1

    02e13274b479fac5b4d52b3e5b20302c55fd0ad5

  • SHA256

    09732e5978fb3c2c4dd1940cda89fa46770aeb9bce74e58c61cf65ca79464790

  • SHA512

    0062b8443d4c29e017206e976ba2e293fec0f57a4cad31311e09c67ba1d5114f82a22405762b87a9d9d14b6c550c508e727c7ae01324fb0eade07bd3a83d2269

  • SSDEEP

    6144:TOpslclqXhdBCkWYxuukP1pjSKStVkq/MVJbw:TwslNTBd47GrRMTbw

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1368
      • C:\Users\Admin\AppData\Local\Temp\e011a235dc8fa9746a826a8958ffa919_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\e011a235dc8fa9746a826a8958ffa919_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3040
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2132
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 296
            4⤵
            • Program crash
            PID:1928
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:1812
          • C:\Users\Admin\AppData\Local\Temp\e011a235dc8fa9746a826a8958ffa919_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\e011a235dc8fa9746a826a8958ffa919_JaffaCakes118.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2940
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 248
              4⤵
              • Program crash
              PID:2012

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1368-3-0x00000000025F0000-0x00000000025F1000-memory.dmp

        Filesize

        4KB

      • memory/2132-246-0x00000000000A0000-0x00000000000A1000-memory.dmp

        Filesize

        4KB

      • memory/2132-260-0x00000000000E0000-0x00000000000E1000-memory.dmp

        Filesize

        4KB

      • memory/2132-535-0x0000000010480000-0x00000000104E5000-memory.dmp

        Filesize

        404KB

      • memory/3040-2-0x0000000010410000-0x0000000010475000-memory.dmp

        Filesize

        404KB