Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 22:40

General

  • Target

    fd48f9eec8d7b2a1342b57d0d68e2a90_JaffaCakes118.exe

  • Size

    28KB

  • MD5

    fd48f9eec8d7b2a1342b57d0d68e2a90

  • SHA1

    44ad2d084ae3daee1a8a587d196307c338624b6e

  • SHA256

    ae092b5dc506a34f669c341d50b4baa0922e4cd44283fbbb99f500171230b8f4

  • SHA512

    7e284cbefd376cd483f7a4688266d72d1f9349aafe01c633982fd12b225d12f902fbea13162cd73b170f1520c8f27573b4c63d25b2c3c27357007e31bd732005

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNPM/:Dv8IRRdsxq1DjJcqfL/

Malware Config

Signatures

  • Detects MyDoom family 9 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd48f9eec8d7b2a1342b57d0d68e2a90_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fd48f9eec8d7b2a1342b57d0d68e2a90_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F91VN88R\default[2].htm

    Filesize

    305B

    MD5

    157431349a057954f4227efc1383ecad

    SHA1

    69ccc939e6b36aa1fabb96ad999540a5ab118c48

    SHA256

    8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac

    SHA512

    6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F91VN88R\default[5].htm

    Filesize

    308B

    MD5

    ccfe63b884fe4225fa33f618a54ce37a

    SHA1

    bbb0778c1597eafe7fb9c5c65412f8ab04b2e311

    SHA256

    f7dd5bab49466a4cdb6a7f5a0e07a158f7a1567bd809ed745812469775b33112

    SHA512

    858f345503c89ba075b374764145fba5b1a9d3440d1628edeab0a3e02cc7cbfbe1119c20747026e69d630ed262d3c91c5073ef06823cf727dfcb11605c7c5ff8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIYAG1MM\search[2].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\default[1].htm

    Filesize

    306B

    MD5

    025f7170b4e8923cc39952474f2c9fb5

    SHA1

    2fe7ac0a9376aade5192f62b69333bc3df7a3d1f

    SHA256

    6cced99f63e90c81238b17e10657b74ab2e88ab76c2549d073933b967c58c948

    SHA512

    4016221fcb6fc1b9c5a4dcbd6edf8c980001b35266ed9f0941802e9e00043a94009f36a6a3da6acf6c9733f5a0347468e4e86c5351fc27d62af44d9381e9d497

  • C:\Users\Admin\AppData\Local\Temp\Cab37CE.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar37F0.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\tmp3797.tmp

    Filesize

    28KB

    MD5

    a3ad79e8522efa6cbcae197c1a16f2ff

    SHA1

    761198e1f6b044b4aecfaca545d8cb3d798b28a8

    SHA256

    5f5a21fc4667d9096ba3e3335521b2de6e524579b33bc8cc1a987a7b8e670f94

    SHA512

    1c46b505402e115789079096bbe3520226607bdc55becbdac7cc45324f77f6a25196ff04fe96ad9248842b670f6cca576a0d1a76ff9b4d5dd96a3e3116618d35

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    d2f43dbc38eb78c44a29a079886e5d73

    SHA1

    1d2edcb27c22aee4a27f44776582828103e2be3b

    SHA256

    7da2181a237328c7be8f018ca6a62661e47d038cc4ff01cf86498b6125b3e252

    SHA512

    99ec418ce9294c3daf6dcf28761e66500c14bbe61c349a3161c643f868f9490705d395dc4a896a276673c73e50b9cf2df50d315337a5b62e002117b2c8d12e96

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    cdafe67766bd8efcbb0b7dcc9b296305

    SHA1

    08afaa8e9063ce26b7283f7de5f1dbb9585de87a

    SHA256

    e21c9bfe6c41b0222734b53795dffdcb546c6bf8506e66ce562d2b2218fad3e8

    SHA512

    cb7df3d6f10e59a5946e72e3f1febd29f5d41f5450ff7b94da87be1fccbe70e36b0d6d7d680bddc16b82cd92d0ddc7db6a984a5594ecd7ae54a5fd255db9616a

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2092-29-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-303-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-31-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-57-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-229-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-59-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-36-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-161-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-64-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-69-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-71-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-76-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2092-24-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2724-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2724-70-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2724-160-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2724-63-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2724-58-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2724-228-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2724-56-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2724-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2724-15-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2724-302-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2724-30-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2724-4-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB