Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 18:10

General

  • Target

    10039ca3ebdc7bff3ea1a1d68cbbcc08_JaffaCakes118.exe

  • Size

    318KB

  • MD5

    10039ca3ebdc7bff3ea1a1d68cbbcc08

  • SHA1

    8b247aff21386871f7c5092690a4919fe57699aa

  • SHA256

    9b710bc65ca6aa48e274ed57dd86edbe28e7db6b2f59fe15639bffd24582a8fb

  • SHA512

    08396937afbff296f9d607e48660f20c26ab7b89662dedc8bf478924d40dac514352986694639750f7e1dd87a3aa95cb540d66f011a26e8fd7de6a4c65c3513c

  • SSDEEP

    3072:lkOXLbHL0ZbSPKBGkg1iOGQFSqyIJXf1JFGTpghMLbMvjVUuZxPUvR989EpEvZBh:fXL30wp71iOGelA2j/jrvZla7j7

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10039ca3ebdc7bff3ea1a1d68cbbcc08_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\10039ca3ebdc7bff3ea1a1d68cbbcc08_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\System Tools\SysTools.ini

    Filesize

    1KB

    MD5

    6aaaef6a31579ac19b230829c6ee9910

    SHA1

    5dd611ee11ad69235e7bba8a8b6afb6f93c1017b

    SHA256

    bf33380e9f5f35ebaf2a23370440b60ee4b61455134d3459b2e89743fd4d61b2

    SHA512

    432aa27b9a29d9b5d1d4cb6642ade7cffa06f1e28ee12f02e20312458c7ed437cf96cc3e662ebec530a7df87feb57491e9ca91eb1099d12621c4ba41e51f9449

  • C:\Users\Admin\AppData\Roaming\System Tools\SysTools.ini

    Filesize

    2KB

    MD5

    97a7cf70a736948413499f7acf81e60d

    SHA1

    dcc7ba3118f0b4d0a42e0063423551e73828020f

    SHA256

    647db9755630128092586dc96675eae0a07b2a47d12fc1a49b487597ab63fcc2

    SHA512

    bb028b9e8458a2db292857c3f4ef49a39367cb79eda10b4cf3804af3a6a3a4090157fc239e6e6be4f9d4275c9cd7788afe2c7ace3544924d99e737983d8ca473

  • memory/740-127-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/740-128-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/740-129-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/740-130-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/740-131-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/740-132-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/740-133-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/740-134-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/740-135-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/740-136-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/740-137-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/740-138-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/740-139-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/740-140-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB