Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

eba5081b5e...18.exe

windows7-x64

9

eba5081b5e...18.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2024, 15:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe

  • Size

    524KB

  • MD5

    eba5081b5ebf59b8d1424dc02c3c9747

  • SHA1

    445698520fae19630a964a21aa8788cfe1dda3e3

  • SHA256

    13a9087e79cc756bbc9d68e5a6071ce5a7d3012e00e27153d22d2649f8e885d5

  • SHA512

    4d65e662e43d2451384807dbf528db176b9f0f2edaa6c2ffe1284aad26a2cbc2e9a69f82054e29203c1db38a16ae2d842388af164a24c5fab0d8d592eb28f7ad

  • SSDEEP

    12288:AJuKBAjsT2ws4GrRu2QRqxqlOy8AF05yHk67zR960LF:AJuXsTuRRu2wqNGIyHr96i

Score
9/10
discoveryevasion

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Users\Admin\AppData\Local\Temp\n3828\s3828.exe
      "C:\Users\Admin\AppData\Local\Temp\n3828\s3828.exe" ins.exe /h 46aff3.api.socdn.com /u e79b5525-92fa-11e3-8a58-80c16e6f498c /e 12487288 /v "C:\Users\Admin\AppData\Local\Temp\eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\n3828\s3828.exe
    Filesize

    339KB

    MD5

    7bfe6bbe12a10323b0aa5c1bad6ecd5b

    SHA1

    7ce4508ddfa0200a95cdbfbe66c4c6b5a8b87122

    SHA256

    f15a491ef671ebddcc3710a4817244c18fe1a5dd444c83137c2fbd601d1c7214

    SHA512

    bf0438520ade14a53c7d8a76b7f7e3d8eec9060003954e0da1ee17ed5db024c44a28bae23ebfaa006fd50da400faf9fc77a4dcb1071d0501d753b47a6146d5d7

    Download Submit

  • memory/2004-17-0x000007FEF5FDE000-0x000007FEF5FDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-18-0x0000000000450000-0x000000000045E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2004-19-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2004-20-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2004-21-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2004-22-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2004-23-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

    Filesize

    9.6MB

    Download