Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 16:48

General

  • Target

    fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe

  • Size

    28KB

  • MD5

    fcba78f8acc53be670e24016fd3028d9

  • SHA1

    52992542c5bb196baad517fa9c878afed6691263

  • SHA256

    3e860005f987025e2a77fc7d5bbcf21df32a519fd513ba2e94099aacc6cfc21a

  • SHA512

    7fa5590f57ab42337224ccbb7a1f47a806c03005f7fd4ee25c00180cdcecb802fb68fa3fd9c6b24a66badf0b3f4a6268fe0292ce870c8b0f58766e661dee8572

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNYAV:Dv8IRRdsxq1DjJcqfq

Malware Config

Signatures

  • Detects MyDoom family 6 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp898C.tmp

    Filesize

    28KB

    MD5

    aa3016eb762f6a2ff9196d68a248460a

    SHA1

    71b7c3d6ac256d6d72a306f402e9d8fd5611d854

    SHA256

    43cbec87a2f9e3ecc8f405c1fcd2eb2747b463aeb25456d6195056f99f0548ce

    SHA512

    30892583fb08335221a268a97b67e2d8442cafd1ba43c609a55366386270c61999730cd47551982a413317cd3371e87e98c31967e2253340d29f4e7a28e1d550

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    9ce03a27d9ba2bdba1015ee92ba2b04e

    SHA1

    40c327f02b1679aa9f4550438fb7859b6d80f4f5

    SHA256

    ab48720ca1ba07994d8d1d42e26600195dd9846a494bed8d75c23e82ec1cbbb1

    SHA512

    874a81211478b16ebce04f33c45cff6260fcf2d98d6391345f752a0bc53b8701cf1a52b6042539f159d58039698f8a05c288b1c36e8beae67964df3af35849ce

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/1880-17-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1880-9-0x0000000000220000-0x0000000000228000-memory.dmp

    Filesize

    32KB

  • memory/1880-55-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1880-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1880-86-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1880-84-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1880-91-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1880-4-0x0000000000220000-0x0000000000228000-memory.dmp

    Filesize

    32KB

  • memory/1880-60-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2404-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-61-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-49-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-54-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-42-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-56-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-37-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-44-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-30-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-25-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-85-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-87-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2404-92-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB