Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 15:54

General

  • Target

    0f7a03ff397a95e57cefbdbf8954ea30_JaffaCakes118.exe

  • Size

    494KB

  • MD5

    0f7a03ff397a95e57cefbdbf8954ea30

  • SHA1

    c2bae51fbe3c435cdf66cc55c7829ed76a3b85e5

  • SHA256

    1eea1e550d3f9ef97d42286fef537f3b29a93aa95e8cb859fb793383bcbd731d

  • SHA512

    0a763fe989750731fe703d23f5983e4a85344483f36786b2e678402ef6238b541837fb14681890a1ce69392923eef3916ef9cc9513488bce155a5fb7ad7dad45

  • SSDEEP

    12288:aGSB9TpivQmcKIpbSR/J7zMhv8NtTirdorX6:aF9wImcKI8R/J7zMB8TEdoG

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f7a03ff397a95e57cefbdbf8954ea30_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0f7a03ff397a95e57cefbdbf8954ea30_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\GUOCYOKl.BAT
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:1064
  • C:\Windows\askldjkl.exe
    C:\Windows\askldjkl.exe
    1⤵
    • Executes dropped EXE
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
        PID:1988

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\GUOCYOKl.BAT

      Filesize

      218B

      MD5

      9eabb865e2e0d58f8dc928c9058876bf

      SHA1

      cb5b4eae725f69e4457831242e4355cdb1ed6467

      SHA256

      07fce69cb8d1cd89e8494bf010d1f380e44c29b76fcd15db1afeb471e4ce41c3

      SHA512

      06244d02a785cdf36909d52201c9212445f4188f00e642c320d676c566fd8f2b97c5e5d126fb07753dcb261c1e38c0c66dcadbf9c476ed544ebaaa9246f1a611

    • C:\Windows\askldjkl.exe

      Filesize

      494KB

      MD5

      0f7a03ff397a95e57cefbdbf8954ea30

      SHA1

      c2bae51fbe3c435cdf66cc55c7829ed76a3b85e5

      SHA256

      1eea1e550d3f9ef97d42286fef537f3b29a93aa95e8cb859fb793383bcbd731d

      SHA512

      0a763fe989750731fe703d23f5983e4a85344483f36786b2e678402ef6238b541837fb14681890a1ce69392923eef3916ef9cc9513488bce155a5fb7ad7dad45

    • memory/2236-91-0x0000000001CE0000-0x0000000001D23000-memory.dmp

      Filesize

      268KB

    • memory/2236-103-0x0000000000400000-0x00000000004F4200-memory.dmp

      Filesize

      976KB

    • memory/2236-104-0x0000000001CE0000-0x0000000001D23000-memory.dmp

      Filesize

      268KB

    • memory/2236-110-0x0000000000400000-0x00000000004F4200-memory.dmp

      Filesize

      976KB

    • memory/2236-106-0x0000000000400000-0x00000000004F4200-memory.dmp

      Filesize

      976KB

    • memory/2720-42-0x00000000025A0000-0x00000000025A1000-memory.dmp

      Filesize

      4KB

    • memory/2720-29-0x00000000023F0000-0x00000000023F1000-memory.dmp

      Filesize

      4KB

    • memory/2720-85-0x00000000032F0000-0x00000000032F1000-memory.dmp

      Filesize

      4KB

    • memory/2720-84-0x0000000003300000-0x0000000003301000-memory.dmp

      Filesize

      4KB

    • memory/2720-83-0x00000000032D0000-0x00000000032D1000-memory.dmp

      Filesize

      4KB

    • memory/2720-82-0x00000000032E0000-0x00000000032E1000-memory.dmp

      Filesize

      4KB

    • memory/2720-81-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/2720-80-0x00000000032C0000-0x00000000032C1000-memory.dmp

      Filesize

      4KB

    • memory/2720-79-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2720-78-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/2720-77-0x0000000003270000-0x0000000003271000-memory.dmp

      Filesize

      4KB

    • memory/2720-76-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2720-75-0x0000000003250000-0x0000000003251000-memory.dmp

      Filesize

      4KB

    • memory/2720-74-0x0000000003260000-0x0000000003261000-memory.dmp

      Filesize

      4KB

    • memory/2720-73-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/2720-72-0x0000000003240000-0x0000000003241000-memory.dmp

      Filesize

      4KB

    • memory/2720-71-0x0000000003210000-0x0000000003211000-memory.dmp

      Filesize

      4KB

    • memory/2720-70-0x0000000003220000-0x0000000003221000-memory.dmp

      Filesize

      4KB

    • memory/2720-69-0x00000000031F0000-0x00000000031F1000-memory.dmp

      Filesize

      4KB

    • memory/2720-68-0x0000000003200000-0x0000000003201000-memory.dmp

      Filesize

      4KB

    • memory/2720-67-0x00000000031D0000-0x00000000031D1000-memory.dmp

      Filesize

      4KB

    • memory/2720-66-0x00000000031E0000-0x00000000031E1000-memory.dmp

      Filesize

      4KB

    • memory/2720-65-0x00000000031B0000-0x00000000031B1000-memory.dmp

      Filesize

      4KB

    • memory/2720-64-0x00000000031C0000-0x00000000031C1000-memory.dmp

      Filesize

      4KB

    • memory/2720-63-0x0000000002720000-0x0000000002721000-memory.dmp

      Filesize

      4KB

    • memory/2720-62-0x0000000002730000-0x0000000002731000-memory.dmp

      Filesize

      4KB

    • memory/2720-39-0x0000000002590000-0x0000000002591000-memory.dmp

      Filesize

      4KB

    • memory/2720-60-0x0000000002710000-0x0000000002711000-memory.dmp

      Filesize

      4KB

    • memory/2720-59-0x00000000026E0000-0x00000000026E1000-memory.dmp

      Filesize

      4KB

    • memory/2720-58-0x00000000026F0000-0x00000000026F1000-memory.dmp

      Filesize

      4KB

    • memory/2720-53-0x0000000002660000-0x0000000002661000-memory.dmp

      Filesize

      4KB

    • memory/2720-52-0x0000000002670000-0x0000000002671000-memory.dmp

      Filesize

      4KB

    • memory/2720-51-0x0000000002640000-0x0000000002641000-memory.dmp

      Filesize

      4KB

    • memory/2720-50-0x0000000002650000-0x0000000002651000-memory.dmp

      Filesize

      4KB

    • memory/2720-49-0x0000000002620000-0x0000000002621000-memory.dmp

      Filesize

      4KB

    • memory/2720-48-0x0000000002630000-0x0000000002631000-memory.dmp

      Filesize

      4KB

    • memory/2720-47-0x00000000025E0000-0x00000000025E1000-memory.dmp

      Filesize

      4KB

    • memory/2720-46-0x00000000025F0000-0x00000000025F1000-memory.dmp

      Filesize

      4KB

    • memory/2720-45-0x0000000002600000-0x0000000002601000-memory.dmp

      Filesize

      4KB

    • memory/2720-44-0x00000000025C0000-0x00000000025C1000-memory.dmp

      Filesize

      4KB

    • memory/2720-43-0x00000000025D0000-0x00000000025D1000-memory.dmp

      Filesize

      4KB

    • memory/2720-55-0x0000000002680000-0x0000000002681000-memory.dmp

      Filesize

      4KB

    • memory/2720-41-0x00000000025B0000-0x00000000025B1000-memory.dmp

      Filesize

      4KB

    • memory/2720-40-0x0000000002580000-0x0000000002581000-memory.dmp

      Filesize

      4KB

    • memory/2720-61-0x0000000002700000-0x0000000002701000-memory.dmp

      Filesize

      4KB

    • memory/2720-54-0x0000000002690000-0x0000000002691000-memory.dmp

      Filesize

      4KB

    • memory/2720-33-0x0000000002530000-0x0000000002531000-memory.dmp

      Filesize

      4KB

    • memory/2720-36-0x0000000002540000-0x0000000002541000-memory.dmp

      Filesize

      4KB

    • memory/2720-35-0x0000000002550000-0x0000000002551000-memory.dmp

      Filesize

      4KB

    • memory/2720-34-0x0000000002520000-0x0000000002521000-memory.dmp

      Filesize

      4KB

    • memory/2720-37-0x0000000002570000-0x0000000002571000-memory.dmp

      Filesize

      4KB

    • memory/2720-32-0x0000000002500000-0x0000000002501000-memory.dmp

      Filesize

      4KB

    • memory/2720-31-0x0000000002510000-0x0000000002511000-memory.dmp

      Filesize

      4KB

    • memory/2720-30-0x00000000023E0000-0x00000000023E1000-memory.dmp

      Filesize

      4KB

    • memory/2720-38-0x0000000002560000-0x0000000002561000-memory.dmp

      Filesize

      4KB

    • memory/2720-28-0x00000000020B0000-0x00000000020B1000-memory.dmp

      Filesize

      4KB

    • memory/2720-27-0x00000000023D0000-0x00000000023D1000-memory.dmp

      Filesize

      4KB

    • memory/2720-26-0x0000000002090000-0x0000000002091000-memory.dmp

      Filesize

      4KB

    • memory/2720-25-0x00000000020A0000-0x00000000020A1000-memory.dmp

      Filesize

      4KB

    • memory/2720-24-0x0000000002070000-0x0000000002071000-memory.dmp

      Filesize

      4KB

    • memory/2720-23-0x0000000002080000-0x0000000002081000-memory.dmp

      Filesize

      4KB

    • memory/2720-22-0x0000000002050000-0x0000000002051000-memory.dmp

      Filesize

      4KB

    • memory/2720-21-0x0000000002060000-0x0000000002061000-memory.dmp

      Filesize

      4KB

    • memory/2720-20-0x0000000000820000-0x0000000000821000-memory.dmp

      Filesize

      4KB

    • memory/2720-19-0x0000000002040000-0x0000000002041000-memory.dmp

      Filesize

      4KB

    • memory/2720-18-0x0000000000800000-0x0000000000801000-memory.dmp

      Filesize

      4KB

    • memory/2720-17-0x0000000000810000-0x0000000000811000-memory.dmp

      Filesize

      4KB

    • memory/2720-16-0x00000000007E0000-0x00000000007E1000-memory.dmp

      Filesize

      4KB

    • memory/2720-15-0x00000000007F0000-0x00000000007F1000-memory.dmp

      Filesize

      4KB

    • memory/2720-14-0x00000000007C0000-0x00000000007C1000-memory.dmp

      Filesize

      4KB

    • memory/2720-13-0x00000000007D0000-0x00000000007D1000-memory.dmp

      Filesize

      4KB

    • memory/2720-12-0x0000000000750000-0x0000000000751000-memory.dmp

      Filesize

      4KB

    • memory/2720-11-0x0000000000710000-0x0000000000711000-memory.dmp

      Filesize

      4KB

    • memory/2720-10-0x0000000000700000-0x0000000000701000-memory.dmp

      Filesize

      4KB

    • memory/2720-9-0x0000000000740000-0x0000000000741000-memory.dmp

      Filesize

      4KB

    • memory/2720-8-0x0000000000720000-0x0000000000721000-memory.dmp

      Filesize

      4KB

    • memory/2720-6-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/2720-5-0x00000000003A0000-0x00000000003A1000-memory.dmp

      Filesize

      4KB

    • memory/2720-4-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2720-3-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/2720-2-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

    • memory/2720-1-0x0000000000330000-0x0000000000373000-memory.dmp

      Filesize

      268KB

    • memory/2720-87-0x0000000003310000-0x0000000003311000-memory.dmp

      Filesize

      4KB

    • memory/2720-86-0x0000000003320000-0x0000000003321000-memory.dmp

      Filesize

      4KB

    • memory/2720-89-0x0000000000400000-0x00000000004F4200-memory.dmp

      Filesize

      976KB

    • memory/2720-90-0x0000000000330000-0x0000000000373000-memory.dmp

      Filesize

      268KB

    • memory/2720-7-0x0000000000730000-0x0000000000733000-memory.dmp

      Filesize

      12KB

    • memory/2720-0-0x0000000000400000-0x00000000004F4200-memory.dmp

      Filesize

      976KB

    • memory/2720-101-0x0000000000330000-0x0000000000373000-memory.dmp

      Filesize

      268KB

    • memory/2720-100-0x0000000000400000-0x00000000004F4200-memory.dmp

      Filesize

      976KB