Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 10:23

General

  • Target

    0572dc95aa995ecf7ff8e01e4fd306b0_JaffaCakes118.exe

  • Size

    24.4MB

  • MD5

    0572dc95aa995ecf7ff8e01e4fd306b0

  • SHA1

    612e986063550a2ec6247360370ef5052f9b6177

  • SHA256

    524e2df81274262da706ae4e5f29089427ad39ba0f9ba9a1c20b565505801fef

  • SHA512

    185828c7ba7668a60e7bcd692923d1d49dd7597161f97dd95be00b2aee43090adca8282d293b50a7784530bd91d5789812b53247b3f65ab49023c88f797f0e72

  • SSDEEP

    786432:ZybpiPivjp3A2FFVrFAC0G8BL+TRt7bF/t:Zu4aFQ0Vr0BgRt/F/t

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0572dc95aa995ecf7ff8e01e4fd306b0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0572dc95aa995ecf7ff8e01e4fd306b0_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsy782E.tmp\ioSpecial.ini

    Filesize

    615B

    MD5

    13ac4d1ae3aa9122007892859598a987

    SHA1

    c5907b5f407ac98a09a81248bf066ca136ea16b4

    SHA256

    780a4fc0c23dd9b0cd670549d1ce3d20d545502f2299f75d34335a8e250335f8

    SHA512

    197a324e103ae14a097dd7ff60b70deea65cf08500f4ab8b080995ec4e05584c79819dac6cc9937b783cda7acbe60723cb8c0c3a4cbfa5862d3455bfcae37d9f

  • \Users\Admin\AppData\Local\Temp\nsy782E.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    0dc0cc7a6d9db685bf05a7e5f3ea4781

    SHA1

    5d8b6268eeec9d8d904bc9d988a4b588b392213f

    SHA256

    8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

    SHA512

    814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0