Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 17:24

General

  • Target

    f67fcbc55e6ff59bd37bc72cc5de178b_JaffaCakes118.exe

  • Size

    311KB

  • MD5

    f67fcbc55e6ff59bd37bc72cc5de178b

  • SHA1

    00bdb5a6f30c17404482f43e7fe72bcde0a2dfc2

  • SHA256

    7a93b3d18a91b70cbf5f63e2b93686dc90f2c1c241ec92f128c6e40bd1e2ba3e

  • SHA512

    22b059cb6d6dd6765d1e03d37a541d4ffcc6089687f54377cd21f2c7e34a89e6195115fbc90fd284412f462c8d885a653fc458f43be745faef9f4dfde81a895a

  • SSDEEP

    6144:xFLaRhPNsDQl/IZZ00wJJQPXvNXvQVG25PlaACWaX9lJBHg62EHi:xNUhPlA0UPfNXKGWPEfNlJBHgQ

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f67fcbc55e6ff59bd37bc72cc5de178b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f67fcbc55e6ff59bd37bc72cc5de178b_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f67fcbc55e6ff59bd37bc72cc5de178b_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\appvernom.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2340
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\appvernom.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3044
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\AppData\Local\appvernom.exe
      "C:\Users\Admin\AppData\Local\appvernom.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1348
      • C:\Users\Admin\AppData\Local\appvernom.exe
        "C:\Users\Admin\AppData\Local\appvernom.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\appvernom.exe

    Filesize

    311KB

    MD5

    f67fcbc55e6ff59bd37bc72cc5de178b

    SHA1

    00bdb5a6f30c17404482f43e7fe72bcde0a2dfc2

    SHA256

    7a93b3d18a91b70cbf5f63e2b93686dc90f2c1c241ec92f128c6e40bd1e2ba3e

    SHA512

    22b059cb6d6dd6765d1e03d37a541d4ffcc6089687f54377cd21f2c7e34a89e6195115fbc90fd284412f462c8d885a653fc458f43be745faef9f4dfde81a895a

  • memory/1348-13-0x0000000000900000-0x0000000000958000-memory.dmp

    Filesize

    352KB

  • memory/2332-26-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/2332-25-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/2332-23-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/2332-20-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/2332-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2332-18-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/2332-16-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/2440-4-0x0000000073CC0000-0x00000000743AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2440-10-0x0000000073CC0000-0x00000000743AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2440-9-0x0000000073CC0000-0x00000000743AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2440-8-0x0000000073CCE000-0x0000000073CCF000-memory.dmp

    Filesize

    4KB

  • memory/2440-5-0x0000000073CC0000-0x00000000743AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2440-0-0x0000000073CCE000-0x0000000073CCF000-memory.dmp

    Filesize

    4KB

  • memory/2440-3-0x00000000002F0000-0x0000000000318000-memory.dmp

    Filesize

    160KB

  • memory/2440-2-0x0000000000270000-0x00000000002B2000-memory.dmp

    Filesize

    264KB

  • memory/2440-1-0x0000000000210000-0x0000000000268000-memory.dmp

    Filesize

    352KB