Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 16:07

General

  • Target

    f026c151c982d18140c4d7c6dccf5566_JaffaCakes118.exe

  • Size

    384KB

  • MD5

    f026c151c982d18140c4d7c6dccf5566

  • SHA1

    3d8dcf38c57980a224a7b82121f85c67bb2257fe

  • SHA256

    0674c95248258ac80daf7ef39d1cf76c204bf2fbabc1386e6fe93b90d5eabc67

  • SHA512

    0344d0b128530f6857167747ad4ce2b585c8191bfa03807896984933a41d615b814a4391241020506cd54cfbe5e380c91c676ce4602750e196ba5d57051fb995

  • SSDEEP

    6144:qzZwJN7oHfdrekyFUEJHJmYgZktfWC4K/GziIIVX8aKrlcxmlF:6iJZ2fdrZjsUWwJiX8aOlx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1132
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1180
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1260
          • C:\Users\Admin\AppData\Local\Temp\f026c151c982d18140c4d7c6dccf5566_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\f026c151c982d18140c4d7c6dccf5566_JaffaCakes118.exe"
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of UnmapMainImage
            • Suspicious use of WriteProcessMemory
            PID:2324
            • C:\Users\Admin\AppData\Roaming\Zyka\yfiv.exe
              "C:\Users\Admin\AppData\Roaming\Zyka\yfiv.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of UnmapMainImage
              • Suspicious use of WriteProcessMemory
              PID:2788
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp19342d5c.bat"
              3⤵
              • Deletes itself
              • System Location Discovery: System Language Discovery
              PID:1220
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1636

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmp19342d5c.bat

            Filesize

            271B

            MD5

            03887fb00b1ecee9a4cb6fb088da0af0

            SHA1

            02bc32b71dcf57eab0fa4d34683d1d3f57c8f698

            SHA256

            abc8b2c65f7bc1b21ce62c90f1a013140329060e7aa935782f8e4ea81738e7cb

            SHA512

            1901ba9bcc5d8412c7251272b5d88244dce9d792f16172219e373db33750722da3abac988a4434c325f97823d554ff652470b10a0ffa82d3e5c81b7dac36883b

          • C:\Users\Admin\AppData\Roaming\Zyka\yfiv.exe

            Filesize

            384KB

            MD5

            34e3be7daa74cd25743903609cb6a7fe

            SHA1

            3f03839324e6dccc8ce8d9258bbf61f667f6c6e6

            SHA256

            53e05397035328da47f0fb97acad33df76ec6ab582df2f3bb132b1195474d604

            SHA512

            4e6c90605394ebf48e44d14be266ca68577d9515fe818be99edb0af6fb180010f1f6f4f04b817ce38d6f6e8578fa68684c35b729dc2068ec5e3c35889ca6796b

          • memory/1132-19-0x0000000002210000-0x0000000002254000-memory.dmp

            Filesize

            272KB

          • memory/1132-21-0x0000000002210000-0x0000000002254000-memory.dmp

            Filesize

            272KB

          • memory/1132-23-0x0000000002210000-0x0000000002254000-memory.dmp

            Filesize

            272KB

          • memory/1132-25-0x0000000002210000-0x0000000002254000-memory.dmp

            Filesize

            272KB

          • memory/1132-27-0x0000000002210000-0x0000000002254000-memory.dmp

            Filesize

            272KB

          • memory/1180-32-0x0000000001F90000-0x0000000001FD4000-memory.dmp

            Filesize

            272KB

          • memory/1180-30-0x0000000001F90000-0x0000000001FD4000-memory.dmp

            Filesize

            272KB

          • memory/1180-34-0x0000000001F90000-0x0000000001FD4000-memory.dmp

            Filesize

            272KB

          • memory/1180-31-0x0000000001F90000-0x0000000001FD4000-memory.dmp

            Filesize

            272KB

          • memory/1260-37-0x00000000025A0000-0x00000000025E4000-memory.dmp

            Filesize

            272KB

          • memory/1260-38-0x00000000025A0000-0x00000000025E4000-memory.dmp

            Filesize

            272KB

          • memory/1260-39-0x00000000025A0000-0x00000000025E4000-memory.dmp

            Filesize

            272KB

          • memory/1260-40-0x00000000025A0000-0x00000000025E4000-memory.dmp

            Filesize

            272KB

          • memory/1636-42-0x0000000001DC0000-0x0000000001E04000-memory.dmp

            Filesize

            272KB

          • memory/1636-44-0x0000000001DC0000-0x0000000001E04000-memory.dmp

            Filesize

            272KB

          • memory/1636-46-0x0000000001DC0000-0x0000000001E04000-memory.dmp

            Filesize

            272KB

          • memory/1636-47-0x0000000001DC0000-0x0000000001E04000-memory.dmp

            Filesize

            272KB

          • memory/2324-57-0x0000000001FB0000-0x0000000001FF4000-memory.dmp

            Filesize

            272KB

          • memory/2324-78-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2324-68-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2324-164-0x0000000000400000-0x0000000000444000-memory.dmp

            Filesize

            272KB

          • memory/2324-72-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2324-163-0x0000000000370000-0x00000000003D3000-memory.dmp

            Filesize

            396KB

          • memory/2324-66-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2324-64-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2324-62-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2324-60-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2324-53-0x0000000001FB0000-0x0000000001FF4000-memory.dmp

            Filesize

            272KB

          • memory/2324-51-0x0000000001FB0000-0x0000000001FF4000-memory.dmp

            Filesize

            272KB

          • memory/2324-49-0x0000000001FB0000-0x0000000001FF4000-memory.dmp

            Filesize

            272KB

          • memory/2324-74-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2324-76-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2324-70-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2324-140-0x0000000077210000-0x0000000077211000-memory.dmp

            Filesize

            4KB

          • memory/2324-141-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2324-80-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2324-2-0x0000000000400000-0x0000000000444000-memory.dmp

            Filesize

            272KB

          • memory/2324-55-0x0000000001FB0000-0x0000000001FF4000-memory.dmp

            Filesize

            272KB

          • memory/2324-1-0x0000000000370000-0x00000000003D3000-memory.dmp

            Filesize

            396KB

          • memory/2324-0-0x0000000000300000-0x0000000000344000-memory.dmp

            Filesize

            272KB

          • memory/2324-58-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2324-5-0x0000000000400000-0x0000000000444000-memory.dmp

            Filesize

            272KB

          • memory/2324-3-0x0000000000400000-0x0000000000444000-memory.dmp

            Filesize

            272KB

          • memory/2324-4-0x0000000000400000-0x0000000000444000-memory.dmp

            Filesize

            272KB

          • memory/2788-17-0x0000000000400000-0x0000000000444000-memory.dmp

            Filesize

            272KB

          • memory/2788-16-0x0000000000360000-0x00000000003C3000-memory.dmp

            Filesize

            396KB

          • memory/2788-15-0x0000000000280000-0x00000000002C4000-memory.dmp

            Filesize

            272KB

          • memory/2788-287-0x0000000000400000-0x0000000000444000-memory.dmp

            Filesize

            272KB