Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 04:16

General

  • Target

    ef0cf6988749211bca2afd29536f7a97_JaffaCakes118.exe

  • Size

    2.5MB

  • MD5

    ef0cf6988749211bca2afd29536f7a97

  • SHA1

    70325035b5c03b23ec7f292470c3d427e7bdcdba

  • SHA256

    9d2290f444d64d64225c51448a4d24438b7b22c2e0b2f9d2301015ba074be393

  • SHA512

    5dc5317638b4ffc6b9dff90eed3defe7328043fece44a9fde2b4cdbbd38ad6371ba3705e7231403211755ac7256cde57ec5b3d9c3d5cfaef3032cbee2ffc2f62

  • SSDEEP

    49152:TLFGzCcot3LT6HyBIeNkcVEwhxJOorSkL0cmAvj988NvRElQb8eo8/1mJ:TLFeot3HIeNkcFK/kLpvGWvGSb8vJ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef0cf6988749211bca2afd29536f7a97_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ef0cf6988749211bca2afd29536f7a97_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsdA9A8.tmp\ioSpecial.ini

    Filesize

    616B

    MD5

    16ace2c50b63dd918f459e7270281116

    SHA1

    d52014a37ec4849f87afc6764853f331d0c8bcf5

    SHA256

    2d3905ebb89fd47dc97c06182f1f9c4cfc3c2e5b3e4cc35cec6b287901d1919c

    SHA512

    f80a857a12a01ed0c26d15e5c8856ffc1e41891d425fe860f5466f58f057822f6f6993bcdf5e30d6cc2a006a42725c34d13303d8143d4fe5326cdd9149c0814a

  • \Users\Admin\AppData\Local\Temp\nsdA9A8.tmp\BrandingURL.dll

    Filesize

    3KB

    MD5

    9c3488b5e9655d1837c3963ecec33f70

    SHA1

    f0fa9b4c29e75c6e4419c4633d09f2797aee2ef3

    SHA256

    05ef4beb7fab9d04c1fb251874166fa2d73a34b4a7f2b145d37a2fd00c88979a

    SHA512

    6af9f88d65d2279a71620f2a656062b1737b3a9a1692ed4e5887bdee891ce08d21c5c0b25ab3acbe6da9fe255dcd7f8a517c2751e73dc56add216740c945e4a7

  • \Users\Admin\AppData\Local\Temp\nsdA9A8.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    b18dfaded8f6d2380fdfd8f6b6969211

    SHA1

    969fa0e906240ab1123254feeb833c275626cf76

    SHA256

    747d0222b652dbfc85e0de4f8486473662d325a55e32c7eacb91e53e37ceba58

    SHA512

    25fb09b8657997d31e61c908f1cd08357c1a1b68bbb1ba377e87b6a3eb347a2ef96c1a771b6c4332853abb33728c55c83efa73df5da03f3dfc132f8a69a2886c