Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2024, 16:21

General

  • Target

    024217eee63eafd4be0bdc4aa2c04f00_JaffaCakes118.exe

  • Size

    2.1MB

  • MD5

    024217eee63eafd4be0bdc4aa2c04f00

  • SHA1

    4b5dc3e55b2f52f4c43bbbbc17cc6625c0cfdb41

  • SHA256

    4c37d56b531602eddf4b1e2923c2c86426ed717a35b7c98d3c57c500f594298b

  • SHA512

    da56624783d1aae4365f977731fa3c96c06b82e8777f92dc2398f3d75f3b08888f4212ce3a176ede8e418b3e8d117512c614f2331cd47266adc5d493d4e4a544

  • SSDEEP

    1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\024217eee63eafd4be0bdc4aa2c04f00_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\024217eee63eafd4be0bdc4aa2c04f00_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\$$$$$.bat
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$$$$$.bat

    Filesize

    228B

    MD5

    802d2c1258f674536b41a8879df6fc91

    SHA1

    bca2071d2ea00146c0e4d62cb7694531f15a0ac0

    SHA256

    b8c20c30afc14d9f4a80872413b691e21cfdfeee0ec38655160c9f1e3e34d3fc

    SHA512

    280fe45a7adccd982f31ef6765573e64f1f535476d9dc566c2a64d0a38646d5fb193aae259a8e27f11c4bd7818ed51b18a4a70881857863954e982a4346fc6e3

  • C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

    Filesize

    2.1MB

    MD5

    024217eee63eafd4be0bdc4aa2c04f00

    SHA1

    4b5dc3e55b2f52f4c43bbbbc17cc6625c0cfdb41

    SHA256

    4c37d56b531602eddf4b1e2923c2c86426ed717a35b7c98d3c57c500f594298b

    SHA512

    da56624783d1aae4365f977731fa3c96c06b82e8777f92dc2398f3d75f3b08888f4212ce3a176ede8e418b3e8d117512c614f2331cd47266adc5d493d4e4a544

  • memory/2352-0-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2352-520-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2352-826-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB