Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2024, 15:32

General

  • Target

    eba29d7c748c07c33334aeb39f1bfe0e_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    eba29d7c748c07c33334aeb39f1bfe0e

  • SHA1

    c1dea7399bbc1ce4269bcd95cfe74d096b342392

  • SHA256

    10bc207a49c42553abfdaf6bad13228ed662c38de58a8132c3c7155f7319163b

  • SHA512

    d43c44575afa3d60f836df6d2a2271c06ace31ebf2a38f81572b8948b021c9c11ab3dd4efa377c3801410f52a77c016fc4a34f83e0c1550d75e548984a54d0d9

  • SSDEEP

    12288:4vO2jCbhwdKLPYs0E55JJ5PsLk1rmiUpXwN0PxNBxliM5MPSx/B6zc:emYsL55heZd5PiMsSx/B6zc

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Drops file in System32 directory 7 IoCs
  • Drops file in Windows directory 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eba29d7c748c07c33334aeb39f1bfe0e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eba29d7c748c07c33334aeb39f1bfe0e_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Windows\SysWOW64\fservice.exe
      C:\Windows\system32\fservice.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Windows\winlogon.exe
        C:\Windows\winlogon.exe -XP
        3⤵
        • Modifies WinLogon for persistence
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2524
        • C:\Windows\SysWOW64\NET.exe
          NET STOP SharedAccess
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2876
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP SharedAccess
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\fservice.exe

    Filesize

    1.9MB

    MD5

    eba29d7c748c07c33334aeb39f1bfe0e

    SHA1

    c1dea7399bbc1ce4269bcd95cfe74d096b342392

    SHA256

    10bc207a49c42553abfdaf6bad13228ed662c38de58a8132c3c7155f7319163b

    SHA512

    d43c44575afa3d60f836df6d2a2271c06ace31ebf2a38f81572b8948b021c9c11ab3dd4efa377c3801410f52a77c016fc4a34f83e0c1550d75e548984a54d0d9

  • \Windows\SysWOW64\wininv.dll

    Filesize

    24KB

    MD5

    f44e9190900ae1ff43d951dc12691e6c

    SHA1

    b17cb75f21486fdf0fff99c0313a7156a62653b8

    SHA256

    1feb2aea58b433b163612d51f454862d9e2921624be878cb26d8609e2c6d1cc0

    SHA512

    8d3c0fe7ccd4cae8bafedf08b92c6fd344a008063c9511def1c5399583336a2034543db15e75fdc42c16e70d14055263aac06240b457b57bd859520b4f3ba714

  • \Windows\SysWOW64\winkey.dll

    Filesize

    24KB

    MD5

    c24d86c806c4b9f0783c486483b48097

    SHA1

    94ad47858a88ceea3e0b7ef0f0cd426490a85258

    SHA256

    bd0316f0231bda178be580e8f66265b6e33ebd7d30eb24c9fbc7d69668f2bc70

    SHA512

    80fccf0c26ae7497ed5f7fafb8b0e990af5a9b0f3799e35b17c9d309d4d4654b3ae6415f1f5e10923cacba8d60ad0e0e809b15feb4fc709ee55fd0fb49c10dbf

  • memory/2524-22-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2524-26-0x00000000760B1000-0x00000000760B2000-memory.dmp

    Filesize

    4KB

  • memory/2524-30-0x00000000760B0000-0x00000000760DA000-memory.dmp

    Filesize

    168KB

  • memory/2524-38-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2524-39-0x0000000000400000-0x00000000005EB000-memory.dmp

    Filesize

    1.9MB

  • memory/2524-42-0x0000000000400000-0x00000000005EB000-memory.dmp

    Filesize

    1.9MB

  • memory/2724-12-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2724-34-0x0000000000400000-0x00000000005EB000-memory.dmp

    Filesize

    1.9MB

  • memory/3064-0-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/3064-35-0x0000000000400000-0x00000000005EB000-memory.dmp

    Filesize

    1.9MB