Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 04:09

General

  • Target

    f526348d63436c1f649d617ff0d055c3_JaffaCakes118.exe

  • Size

    127KB

  • MD5

    f526348d63436c1f649d617ff0d055c3

  • SHA1

    91e1c7733928dbf135ab32e84e2c61a7586652b7

  • SHA256

    a4467dccb32edd2ba60b49b7fce1753d3ee1bdbe0164b3529a3bd04a6d2c325d

  • SHA512

    7664aa0ba931e0dceda34765803bd7569646e303208f1ed56875871831269aaa6acf56f335fe92297cb2e06b79391427b52e92684dbe2f59042469978462b016

  • SSDEEP

    3072:9ZXgU7xP3EaedXKP1VMOjdAeL4QMLqQkkZ:9ZN/r1VtqnhBZ

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1108
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1160
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1200
          • C:\Users\Admin\AppData\Local\Temp\f526348d63436c1f649d617ff0d055c3_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\f526348d63436c1f649d617ff0d055c3_JaffaCakes118.exe"
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2740
            • C:\Users\Admin\AppData\Roaming\L736\7kav.exe
              "C:\Users\Admin\AppData\Roaming\L736\7kav.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2748
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp0d7455e6.bat"
              3⤵
              • Deletes itself
              • System Location Discovery: System Language Discovery
              PID:1588
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1260
          • C:\Program Files\Windows Mail\WinMail.exe
            "C:\Program Files\Windows Mail\WinMail.exe" -Embedding
            1⤵
            • NTFS ADS
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:2576
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
            1⤵
              PID:2620
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
              1⤵
                PID:1808

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log

                Filesize

                2.0MB

                MD5

                64be70d0c71c865d04fca49fd48ea0bd

                SHA1

                43659fc281f22feaa7ccbe726e17554c795b61d0

                SHA256

                f48ab33e61e3c6e14d0bc35bfaea6fe41a7233ef10187ee3e0f37deeee501fec

                SHA512

                5d2b93e1a903d90d524705d87059ed08d129ebe62cb3a925a17ef4886c71e26959bb8049448b743539764d9aef563bf10eaa79384da838f9c0b1b3aa075f8b41

              • C:\Users\Admin\AppData\Local\Temp\tmp0d7455e6.bat

                Filesize

                271B

                MD5

                d89959f3bbca91886726574716468f4a

                SHA1

                dc7ded2c49f43be365e4ca26910106d675519da4

                SHA256

                469798241768e00f26bd9bc380cf09bfa4cefdbff3d6508441d78b105436770c

                SHA512

                aa47b1229db9b3747aa2266f9f9ded994ae1b9e1cd6ea9e23c0fbcc532e0ca847fbc2dfd7c3a7161839c8e0cbaa869a9f73e1940916d88241650699362659e8d

              • \Users\Admin\AppData\Roaming\L736\7kav.exe

                Filesize

                127KB

                MD5

                ebd0fa86e11509e5ffc790734f35fb53

                SHA1

                bfe3a9902cd06399e793d18cf6506ead7a0855ee

                SHA256

                89c13c96bf36b2ab27c7c88236d844445b36837087ccf4e06b08f1141b98ad45

                SHA512

                3c9607dbf3e10cc83c5486cd6e90456ffb5a49674e9709f66e847fbc37b730e0dddadb9637f6f920b035214427613cf1d0c8633554a1ffa04c3239b4a78ccf02

              • memory/1108-29-0x0000000002100000-0x0000000002123000-memory.dmp

                Filesize

                140KB

              • memory/1108-26-0x0000000002100000-0x0000000002123000-memory.dmp

                Filesize

                140KB

              • memory/1108-24-0x0000000002100000-0x0000000002123000-memory.dmp

                Filesize

                140KB

              • memory/1108-27-0x0000000002100000-0x0000000002123000-memory.dmp

                Filesize

                140KB

              • memory/1108-28-0x0000000002100000-0x0000000002123000-memory.dmp

                Filesize

                140KB

              • memory/1160-34-0x00000000001B0000-0x00000000001D3000-memory.dmp

                Filesize

                140KB

              • memory/1160-32-0x00000000001B0000-0x00000000001D3000-memory.dmp

                Filesize

                140KB

              • memory/1160-36-0x00000000001B0000-0x00000000001D3000-memory.dmp

                Filesize

                140KB

              • memory/1160-38-0x00000000001B0000-0x00000000001D3000-memory.dmp

                Filesize

                140KB

              • memory/1200-41-0x0000000002DF0000-0x0000000002E13000-memory.dmp

                Filesize

                140KB

              • memory/1200-42-0x0000000002DF0000-0x0000000002E13000-memory.dmp

                Filesize

                140KB

              • memory/1200-43-0x0000000002DF0000-0x0000000002E13000-memory.dmp

                Filesize

                140KB

              • memory/1200-44-0x0000000002DF0000-0x0000000002E13000-memory.dmp

                Filesize

                140KB

              • memory/1260-49-0x0000000001F90000-0x0000000001FB3000-memory.dmp

                Filesize

                140KB

              • memory/1260-50-0x0000000001F90000-0x0000000001FB3000-memory.dmp

                Filesize

                140KB

              • memory/1260-47-0x0000000001F90000-0x0000000001FB3000-memory.dmp

                Filesize

                140KB

              • memory/1260-48-0x0000000001F90000-0x0000000001FB3000-memory.dmp

                Filesize

                140KB

              • memory/2740-56-0x0000000002660000-0x0000000002683000-memory.dmp

                Filesize

                140KB

              • memory/2740-129-0x0000000002660000-0x000000000269F000-memory.dmp

                Filesize

                252KB

              • memory/2740-53-0x0000000002660000-0x0000000002683000-memory.dmp

                Filesize

                140KB

              • memory/2740-57-0x0000000002660000-0x000000000269F000-memory.dmp

                Filesize

                252KB

              • memory/2740-54-0x0000000002660000-0x0000000002683000-memory.dmp

                Filesize

                140KB

              • memory/2740-55-0x0000000002660000-0x0000000002683000-memory.dmp

                Filesize

                140KB

              • memory/2740-0-0x0000000000400000-0x000000000043F000-memory.dmp

                Filesize

                252KB

              • memory/2740-2-0x0000000000400000-0x000000000043F000-memory.dmp

                Filesize

                252KB

              • memory/2740-234-0x0000000000400000-0x000000000043F000-memory.dmp

                Filesize

                252KB

              • memory/2740-235-0x0000000002660000-0x0000000002683000-memory.dmp

                Filesize

                140KB

              • memory/2740-14-0x0000000002660000-0x000000000269F000-memory.dmp

                Filesize

                252KB

              • memory/2740-17-0x0000000000402000-0x0000000000403000-memory.dmp

                Filesize

                4KB

              • memory/2740-1-0x0000000000402000-0x0000000000403000-memory.dmp

                Filesize

                4KB

              • memory/2740-15-0x0000000000400000-0x000000000043F000-memory.dmp

                Filesize

                252KB

              • memory/2740-5-0x0000000000400000-0x000000000043F000-memory.dmp

                Filesize

                252KB

              • memory/2740-4-0x0000000000400000-0x000000000043F000-memory.dmp

                Filesize

                252KB

              • memory/2740-58-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-3-0x0000000000400000-0x000000000043F000-memory.dmp

                Filesize

                252KB

              • memory/2740-62-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-52-0x0000000002660000-0x0000000002683000-memory.dmp

                Filesize

                140KB

              • memory/2740-60-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-88-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-86-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-84-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-82-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-80-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-78-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-76-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-74-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-72-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-70-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-68-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-66-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2740-64-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

              • memory/2748-134-0x0000000000400000-0x000000000043F000-memory.dmp

                Filesize

                252KB

              • memory/2748-23-0x0000000000400000-0x000000000043F000-memory.dmp

                Filesize

                252KB

              • memory/2748-18-0x0000000000400000-0x000000000043F000-memory.dmp

                Filesize

                252KB

              • memory/2748-20-0x0000000000400000-0x000000000043F000-memory.dmp

                Filesize

                252KB

              • memory/2748-19-0x0000000000400000-0x000000000043F000-memory.dmp

                Filesize

                252KB

              • memory/2748-21-0x0000000000400000-0x000000000043F000-memory.dmp

                Filesize

                252KB