Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

ef5f42659b...18.exe

windows7-x64

8

ef5f42659b...18.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 08:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ef5f42659bfa48d7896fe04434a2c7ca_JaffaCakes118.exe

  • Size

    192KB

  • MD5

    ef5f42659bfa48d7896fe04434a2c7ca

  • SHA1

    55515f10c8205c7a88ea972653328a9841e6704d

  • SHA256

    380fa37adcda144ee6c59ec251b976074fd8b7c48380df72ffa8769ea13f600f

  • SHA512

    c68408431521a930c24c4123328b8e0c6f9d19da7474ffeaa3a36f66ec90b4d1b1feb814035acd2455e3fff09f8fbcc028665c2ed79735fb19a929be780c3d34

  • SSDEEP

    3072:YpbtC5W7S8BFsPolqmDOn542beDNLbD8BpPq32:T5W7S8BGWqkxl4D

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 9 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef5f42659bfa48d7896fe04434a2c7ca_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ef5f42659bfa48d7896fe04434a2c7ca_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:1056
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2736
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x5a4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\SMAVVV.dll
    Filesize

    140KB

    MD5

    7caae81ab9bacfedd96f88b852bda4c0

    SHA1

    a15bd7cd06cf6c1a5f855ef584ba159902de3811

    SHA256

    319e87393f5eb1b80cb11fb43abf0cd25c19929460e40c5cf3528c73bcba9433

    SHA512

    a5a9ce67102caa9c7296abdce34f53dc39b57d42580046d8c7eb25a03f48d07de02090d3ba5a8eba50f2c31e2ec84eecde811e697789cf2a39d6c805f896979e

    Download Submit

  • memory/1056-1-0x000000007EF90000-0x000000007EFB0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1056-4-0x000000007EF70000-0x000000007EF8A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1056-5-0x000000007EF30000-0x000000007EF68000-memory.dmp

    Filesize

    224KB

    Download

  • memory/1056-9-0x000000007EF30000-0x000000007EF68000-memory.dmp

    Filesize

    224KB

    Download