Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 15:49

General

  • Target

    fca0e51a2bdfce2622592fa6f548241c_JaffaCakes118.exe

  • Size

    28KB

  • MD5

    fca0e51a2bdfce2622592fa6f548241c

  • SHA1

    6c981e14c2c8aee7c21f6e18ae976ca04b3402d1

  • SHA256

    e3992680cc5121ea8bba98a95c7c476c088c76493cd46a5da93633808af82dd5

  • SHA512

    b68a24172da5c0ab315f7091629bfb991bba6be1267b7db7c5ca545e1c91e61051bc5a0d14f3cb88d3c305507855e35c71fa3b02cd52e3233d33dde55bd6811d

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN8Znw603:Dv8IRRdsxq1DjJcqf7Y

Malware Config

Signatures

  • Detects MyDoom family 6 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fca0e51a2bdfce2622592fa6f548241c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fca0e51a2bdfce2622592fa6f548241c_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpF0D6.tmp

    Filesize

    28KB

    MD5

    ba1ba0edf28e19f4299b939548f2db2e

    SHA1

    33ce85be0266daf5356e6b6af813f944061c997e

    SHA256

    f62de53a37f37ff28b60088850fa282a553a47948cd04d79a3e8b7fcc1d14b50

    SHA512

    3494e30dd643f1353505ba1da78bd7a18e225046ad406b1b0869ce506b64b1408f6408865a6c82285484c055fda72119111db1be31af6f99d5e78097948c649d

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    b87f30e7c5fe78423cccfa2b02988ec6

    SHA1

    7cb2b5634feb879d09bf582aa1883bf0a1ccb617

    SHA256

    cc2b24dacd6fbc70ec83199b5d1904536791c5e8b3ec5bfc8f577e8b68588742

    SHA512

    5bf4d6a0cdbadfd22b9692f8d2849194e05eda5ba434c35ba0f1e7c4466f0d13e766e2e556ea1daaa0105e4c3ade8edc95fe4370fb53fe13eac63dc7afed24a2

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2636-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-53-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-91-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-24-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-29-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-31-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-36-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-41-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-43-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-48-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-86-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-84-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-55-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-60-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3044-59-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3044-15-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3044-3-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3044-83-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3044-54-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3044-85-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3044-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3044-90-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3044-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB