Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 05:04

General

  • Target

    047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe

  • Size

    240KB

  • MD5

    047658255b7bbddc5a257cf3ff215438

  • SHA1

    aecdce6aff6df2a95dc730b7f37aa283b1571aee

  • SHA256

    a019efaae1ae721215671a1b88c268bca9a79313be7520d6ed1a0ef531ff7cd3

  • SHA512

    5a2b9dfec9606c500ae7502c425787ba2e986cccc6b516a4339fd057f8fe058260cc6714888a178d0b3fc673536c3e09247e91426a39b5159057354b5fdcf78d

  • SSDEEP

    6144:h1OgDPdkBAFZWjadD4s5/ubqh5BFT/1H5:h1OgLdaOG65BNb

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 4 IoCs
  • Modifies registry class 63 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Users\Admin\AppData\Local\Temp\7zSBA4A.tmp\507ff560dd976.exe
      .\507ff560dd976.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • System policy modification
      PID:3056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\wxDownload\uninstall.exe

    Filesize

    48KB

    MD5

    602aa39f9ab3b6685bee71c67dc485c5

    SHA1

    69cd0d6f9ce55a5e5d3d3559d31422303dc6def1

    SHA256

    d8fb9c21b350a06449c7e6934a3c2d971d20851ce73938bbc5f79349f970721c

    SHA512

    3bb5a0bf89da8993ae2801b41f7644ec39fc418ac0553bc67ed4f36ad413f3c2237ff9bcdd4a1ca64ad546b30e6445d3f6f1fa3af0f34faf1841da306e81ea94

  • C:\Users\Admin\AppData\Local\Temp\7zSBA4A.tmp\507ff560dd9ae.ocx

    Filesize

    126KB

    MD5

    d637295a8426c7c4a8e9ef3e584839a2

    SHA1

    55b64f53328498d22d269de2e65be2feeba7da00

    SHA256

    5cbd7f4b8f991ccab51cfc1fd0a5437013c5196f3c636632d691103aa3708adb

    SHA512

    f60f908b9f0efd4762255c9c71559bbd554714170262dd556353ddda55789d21cc3a8ade239cdf51da38dfa4e92714749c217095bccac19590ef8347ca501c8c

  • C:\Users\Admin\AppData\Local\Temp\7zSBA4A.tmp\507ff560dd9e7.html

    Filesize

    4KB

    MD5

    820e02d2a58fef7cf76d8d23d61a84b1

    SHA1

    fb37fb0789e7e897567722c1dc60653bdf91c4ae

    SHA256

    96db25268fb5446c2c7b2f5033ee182b50b00e638bfd0f90a5919d7fdfe7ff37

    SHA512

    364b517f007cf9092c02f00982631d2637ecf56e5cfeaebb4831a1731d1ce482f5fe5958ab710adddad21ce4efdbaaa3416e8fd505a7ac1c3a8dc9ab38fa2017

  • C:\Users\Admin\AppData\Local\Temp\7zSBA4A.tmp\507ff560dda20.js

    Filesize

    9B

    MD5

    99fa5d714d971a49b67de27e0d8871be

    SHA1

    d0621e846ea60fa8d0b2c8e622e495af49cd7359

    SHA256

    f560d76474380da948a0c5ab8682dc026822d9685268c592f315224b1b968bf6

    SHA512

    2fec19e4f2a974227922a7e057890141523ae73fbfa127f9e8cd00dff71b29abb93cb865c6d74ecf3df8bca440c558d4fbf2f80e82cc9636320ab5edb95ebad5

  • C:\Users\Admin\AppData\Local\Temp\7zSBA4A.tmp\settings.ini

    Filesize

    753B

    MD5

    4d7f66f35ee47101e69b096be2c6081e

    SHA1

    0521acfd1c936c40ef30bc84a75cb3ca6c5242e3

    SHA256

    8871965c558f9d2d0a04970f32d70df4a137d5f47f6015682f055c76e46bd8b5

    SHA512

    25116250287e0cc15fdfa5f4502ab91bccd95ec3836540996d4b79f32770ed49326ae96e9b897439c98288ecbe195dccb91eb31ef82377b0cbe58193fc318477

  • \Users\Admin\AppData\Local\Temp\7zSBA4A.tmp\507ff560dd976.exe

    Filesize

    65KB

    MD5

    6fce522ef2543f1cd8812f45c8718ba6

    SHA1

    270c89c05963c0f24f976f6b75aa4d12ade4c837

    SHA256

    d75c34545066eb787ed671c6d4ce4f4c6267637518ca683dfefb79f95f14226b

    SHA512

    a0a486b95aeb9c059f23e639e16abdbfe94b041f33309b44e95743bf5a82f92d3c444c025b6c36a0dc296add3c2bc4f6affcf130014f16968be0afa8e0007880

  • \Users\Admin\AppData\Local\Temp\nstBAC8.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    7579ade7ae1747a31960a228ce02e666

    SHA1

    8ec8571a296737e819dcf86353a43fcf8ec63351

    SHA256

    564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    SHA512

    a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b