Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 17:50

General

  • Target

    06cbec45ff91809571145c063b15c77b_JaffaCakes118.exe

  • Size

    143KB

  • MD5

    06cbec45ff91809571145c063b15c77b

  • SHA1

    3d7e4aff1e432e37f49dd142e921fec48850e0f8

  • SHA256

    efc080df21af6c404c159fff3f19c80001335d50611cb373a64a1f411954bf8e

  • SHA512

    34aaffa1332cacb7827db81c6566590f535ba289ed8c7bf94afbed71b38b5d274426f53fa9478218755779a946b3bba0d2d11b2deafa09773b5301165aa78a58

  • SSDEEP

    3072:iQGpgh863FbKDCy01ix7INTWu16y065yl:iQS+7y01iC465q

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1212
      • C:\Users\Admin\AppData\Local\Temp\06cbec45ff91809571145c063b15c77b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\06cbec45ff91809571145c063b15c77b_JaffaCakes118.exe"
        2⤵
        • UAC bypass
        • Windows security bypass
        • Loads dropped DLL
        • Windows security modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2016
        • C:\Users\Admin\AppData\Local\Temp\06cbec45ff91809571145c063b15c77b_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\06cbec45ff91809571145c063b15c77b_JaffaCakes118.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2168

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Windows\SysWOW64\uZQEtNDuIS.dll

      Filesize

      1.1MB

      MD5

      9b98d47916ead4f69ef51b56b0c2323c

      SHA1

      290a80b4ded0efc0fd00816f373fcea81a521330

      SHA256

      96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

      SHA512

      68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

    • memory/1212-27-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

      Filesize

      4KB

    • memory/1212-24-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

      Filesize

      28KB

    • memory/2016-0-0x0000000000400000-0x0000000000425000-memory.dmp

      Filesize

      148KB

    • memory/2016-22-0x0000000000400000-0x0000000000425000-memory.dmp

      Filesize

      148KB

    • memory/2168-21-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2168-19-0x0000000000400000-0x0000000000408960-memory.dmp

      Filesize

      34KB

    • memory/2168-20-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2168-17-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2168-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2168-13-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2168-23-0x0000000000400000-0x0000000000408960-memory.dmp

      Filesize

      34KB

    • memory/2168-11-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2168-9-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB