Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

eeab610470...18.exe

windows7-x64

10

eeab610470...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2024, 23:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eeab610470ed5b6147ed9e7a2a9d0328_JaffaCakes118.exe

  • Size

    67KB

  • MD5

    eeab610470ed5b6147ed9e7a2a9d0328

  • SHA1

    edf6be4af459bed42c79491484c26a8cf90e2783

  • SHA256

    a8278a9570246fa1b33f1392ecd438c39668950cfe04e7623646a1efea674b28

  • SHA512

    0a1131450550c2c2aa4269e7fb07ca89a725de28f415ccb0bc389086340e9b9961e0a8f7002839b97e31ab837f77ad3910e07cd9ece954340d6fabeec0a847ac

  • SSDEEP

    768:eRZ+QyvhsvgOpU/WGGIegFDhNmvdMYXqYt1NEDIefZsD:eHzvgO2/rEgzNLoZt1y

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eeab610470ed5b6147ed9e7a2a9d0328_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eeab610470ed5b6147ed9e7a2a9d0328_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\Admin.exe
    Filesize

    67KB

    MD5

    03d6d96f4365302bb5619ebd83a33828

    SHA1

    6e10dada3df78810628061efc5a1dba1381c9f04

    SHA256

    70bbe946186fb1eb88f728e8efbb5e3ca311decc256b9b913b988b8660ec3817

    SHA512

    cd8e0a0b620d27a11899de60e16d279eb62d2873c6d9fc1a9eb93b20c073cb72f3cacc445c8d91e8a5af76985ce31f940e4712f4d489141fa7dd68a1df747e89

    Download Submit

  • memory/1780-13-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

    Download

  • memory/2092-0-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

    Download