Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2024, 22:32

General

  • Target

    037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe

  • Size

    698KB

  • MD5

    037e013c7f76d47ac65d3e9c1242d15a

  • SHA1

    4594047e1b79af17ae32d0bfac82d9dd8a08ba43

  • SHA256

    9bb1775ef044a7b860f9f69402ac2ff55e3a3db2003dbf274e344154ec62ec40

  • SHA512

    c464cb3488f6cdd82a2fe442341dc767ff64fb66a9dede7a9d0989151339da01bdd7293244a6200999a1024bc65b9b273c2bff993cea013c8142b81d957c97a9

  • SSDEEP

    12288:55ndXmyFqwoesw/rDVzLAuiRhsHuZm8S6F3Z4mxxiDqVTVOCv:55ddFqjwdzcfsHMm8pQmX5VTzv

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\uninstal.bat
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2776
  • C:\Windows\Hacddfker.com.cn.exe
    C:\Windows\Hacddfker.com.cn.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
        PID:2244

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Hacddfker.com.cn.exe

      Filesize

      698KB

      MD5

      037e013c7f76d47ac65d3e9c1242d15a

      SHA1

      4594047e1b79af17ae32d0bfac82d9dd8a08ba43

      SHA256

      9bb1775ef044a7b860f9f69402ac2ff55e3a3db2003dbf274e344154ec62ec40

      SHA512

      c464cb3488f6cdd82a2fe442341dc767ff64fb66a9dede7a9d0989151339da01bdd7293244a6200999a1024bc65b9b273c2bff993cea013c8142b81d957c97a9

    • C:\Windows\uninstal.bat

      Filesize

      218B

      MD5

      8a8a4e55528e0bed81423e1058006dcd

      SHA1

      f8ac34617a008773b5b92c2d79bb8186c3a98ba9

      SHA256

      07a6cb357756c0b4b081bcf91f3f544b6191897b05092f8b2a959345cc772558

      SHA512

      63ab3aae7736e5f8e691a7ad32dc419f298faee5381779bbcadc263dd720390bc50624b18d3240c730ca0460fdb6539553204f7d259330d4d3b8aecddcd869b8

    • memory/2036-0-0x0000000000400000-0x000000000057F000-memory.dmp

      Filesize

      1.5MB

    • memory/2036-1-0x0000000000380000-0x00000000003D4000-memory.dmp

      Filesize

      336KB

    • memory/2036-29-0x00000000020B0000-0x00000000020B1000-memory.dmp

      Filesize

      4KB

    • memory/2036-28-0x00000000020C0000-0x00000000020C1000-memory.dmp

      Filesize

      4KB

    • memory/2036-27-0x0000000000610000-0x0000000000611000-memory.dmp

      Filesize

      4KB

    • memory/2036-26-0x0000000001F40000-0x0000000001F41000-memory.dmp

      Filesize

      4KB

    • memory/2036-25-0x0000000001F60000-0x0000000001F61000-memory.dmp

      Filesize

      4KB

    • memory/2036-24-0x00000000020A0000-0x00000000020A1000-memory.dmp

      Filesize

      4KB

    • memory/2036-23-0x0000000000580000-0x0000000000581000-memory.dmp

      Filesize

      4KB

    • memory/2036-22-0x00000000005F0000-0x00000000005F1000-memory.dmp

      Filesize

      4KB

    • memory/2036-21-0x00000000005C0000-0x00000000005C1000-memory.dmp

      Filesize

      4KB

    • memory/2036-20-0x00000000005D0000-0x00000000005D1000-memory.dmp

      Filesize

      4KB

    • memory/2036-19-0x00000000003E0000-0x00000000003E1000-memory.dmp

      Filesize

      4KB

    • memory/2036-18-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/2036-17-0x00000000005E0000-0x00000000005E1000-memory.dmp

      Filesize

      4KB

    • memory/2036-16-0x0000000000590000-0x0000000000591000-memory.dmp

      Filesize

      4KB

    • memory/2036-15-0x00000000005B0000-0x00000000005B1000-memory.dmp

      Filesize

      4KB

    • memory/2036-14-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/2036-13-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/2036-12-0x0000000000360000-0x0000000000361000-memory.dmp

      Filesize

      4KB

    • memory/2036-11-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/2036-10-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/2036-9-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/2036-8-0x0000000000330000-0x0000000000331000-memory.dmp

      Filesize

      4KB

    • memory/2036-7-0x0000000000340000-0x0000000000341000-memory.dmp

      Filesize

      4KB

    • memory/2036-6-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2036-5-0x00000000002D0000-0x00000000002D1000-memory.dmp

      Filesize

      4KB

    • memory/2036-4-0x0000000000350000-0x0000000000351000-memory.dmp

      Filesize

      4KB

    • memory/2036-3-0x00000000002F0000-0x00000000002F1000-memory.dmp

      Filesize

      4KB

    • memory/2036-2-0x0000000000320000-0x0000000000321000-memory.dmp

      Filesize

      4KB

    • memory/2036-49-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-48-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-47-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-46-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-45-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-44-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-43-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-42-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-41-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-40-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-39-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-38-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-37-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-36-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-35-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-34-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-33-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-32-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-31-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-30-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2036-54-0x0000000000380000-0x00000000003D4000-memory.dmp

      Filesize

      336KB

    • memory/2036-53-0x0000000000400000-0x000000000057F000-memory.dmp

      Filesize

      1.5MB

    • memory/2840-55-0x0000000000400000-0x000000000057F000-memory.dmp

      Filesize

      1.5MB

    • memory/2840-67-0x0000000000400000-0x000000000057F000-memory.dmp

      Filesize

      1.5MB

    • memory/2840-71-0x0000000000400000-0x000000000057F000-memory.dmp

      Filesize

      1.5MB