Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    98s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2024, 02:22

General

  • Target

    ffc275c82998842d86c30db6470b3bda_JaffaCakes118.exe

  • Size

    108KB

  • MD5

    ffc275c82998842d86c30db6470b3bda

  • SHA1

    74da091e253f0f28223c8fb6b25da67940fba3c1

  • SHA256

    c98b5219141b7d0ca663d1dc6237cc05757edb736ea89bbf1e84cea890504fe2

  • SHA512

    1e970c7d9fe9d910cf4cf0c1960872972ea88914a573be9c1f8763122086ff5922eac4cd2051ef0571994eed0c291a9905182557573be6ddb0c8392f8f9735ad

  • SSDEEP

    3072:vQIURTXJ2ceAM8GNeCT6iKjU8i+np8tTcs:vsYmM8GEcDt4s

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ffc275c82998842d86c30db6470b3bda_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ffc275c82998842d86c30db6470b3bda_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsj1325.tmp\Math.dll

    Filesize

    66KB

    MD5

    9eb6cecdd0df9fe32027fcdb51c625af

    SHA1

    52b5b054ff6e7325c3087822901ea2f2c4f9572a

    SHA256

    54cf1572ed47f614b0ffb886c99fc5725f454ef7ff919fbb2fd13d1cbe270560

    SHA512

    864742ec6f74f94057b54cd9b09707c0125ac8db4844fa80af201e8b72a811bb68276c993e75bce67e5ece4f83644572edbdee5e963634c5a37839615faea97a

  • \Users\Admin\AppData\Local\Temp\nsj1325.tmp\System.dll

    Filesize

    11KB

    MD5

    00a0194c20ee912257df53bfe258ee4a

    SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

    SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

  • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    108KB

    MD5

    ffc275c82998842d86c30db6470b3bda

    SHA1

    74da091e253f0f28223c8fb6b25da67940fba3c1

    SHA256

    c98b5219141b7d0ca663d1dc6237cc05757edb736ea89bbf1e84cea890504fe2

    SHA512

    1e970c7d9fe9d910cf4cf0c1960872972ea88914a573be9c1f8763122086ff5922eac4cd2051ef0571994eed0c291a9905182557573be6ddb0c8392f8f9735ad

  • memory/2504-17-0x0000000000570000-0x000000000058A000-memory.dmp

    Filesize

    104KB