Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2024, 22:00

General

  • Target

    ee81789b19d23ba071d7cf40a893200b_JaffaCakes118.exe

  • Size

    184KB

  • MD5

    ee81789b19d23ba071d7cf40a893200b

  • SHA1

    ab1dddc09e6b0a0896b0d274d2a6382e53b37db7

  • SHA256

    411cab6e821f7c351ecfd7d14968c331d1ebb4a15f4cc96283c6587b8cc6e23d

  • SHA512

    2716d81e18be2212109db59d0d9f31691042bc8dbf21c21c3e4961d6616b594af555fbb9fdb2f8024ebd4e450754510ca8653dba1a1bbf9e131fb5e02031d715

  • SSDEEP

    3072:aI5ZVBc9YUdtG716ennADVHMfcRAGKB+uMTEd1CTa:ai4u1tnADVsERAGKB+uSEdl

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee81789b19d23ba071d7cf40a893200b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ee81789b19d23ba071d7cf40a893200b_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:592
    • C:\Users\Admin\cajit.exe
      "C:\Users\Admin\cajit.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\cajit.exe

    Filesize

    184KB

    MD5

    4ec5c229e05973eda027ffd67789c47b

    SHA1

    f4c7f8596ebd87977b2eac0f2777453c75053a77

    SHA256

    1dbd88f31d29a1e1259cfa2925d7af8dd0aa7e3cd710c9d06931b97f4360e485

    SHA512

    1dcd51bb3d839f14fcf12e31f94054ea2eca633e1c3cc03303b5562f0aa0e11886393edf6e1c64732995c80c0797ca398077a0942634bd541b2f68d69ea44583