Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

1145695450...18.exe

windows7-x64

7

1145695450...18.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2024, 01:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1145695450d105130d1e1a3b7b875b57_JaffaCakes118.exe

  • Size

    357KB

  • MD5

    1145695450d105130d1e1a3b7b875b57

  • SHA1

    dd349bee85679549ea93ac035d02f0e7256a22e0

  • SHA256

    a5d075cb848b0e38d2f2510e8b116b8b593d9a68e5441f5b26f6ec478b05b367

  • SHA512

    116634485ffc6c5281508dd0e4f7b1c095d766ca79ff44b80d55d9c5752e2a5582e238af0a108666a50976753cfce470aed42c9838a304e658867a754884e4a4

  • SSDEEP

    6144:TjckxhGotqbSg9RsLvnQAFyhIOKFEjhLzNUTavglyrGtpk2oIPLtpLogTtUITMG9:nxgJ79RCQRI7Edea2YepqIPLtpLTtDTd

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1145695450d105130d1e1a3b7b875b57_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1145695450d105130d1e1a3b7b875b57_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\ProgramData\jNl06511kGoEo06511\jNl06511kGoEo06511.exe
      "C:\ProgramData\jNl06511kGoEo06511\jNl06511kGoEo06511.exe" BOMBARDAMAXIMUM
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:836
    • C:\ProgramData\jNl06511kGoEo06511\jNl06511kGoEo06511.exe
      "C:\ProgramData\jNl06511kGoEo06511\jNl06511kGoEo06511.exe" "C:\Users\Admin\AppData\Local\Temp\1145695450d105130d1e1a3b7b875b57_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\jNl06511kGoEo06511\jNl06511kGoEo06511
    Filesize

    192B

    MD5

    7bdf8928ab17aff62146b41ec3a4432e

    SHA1

    1c58aaf043b9d1adcf5680ed460190cb46a7d115

    SHA256

    0f2f51d37e39a26dd7dc21d8b5242612513435d0e2f4a8740495b413f306b532

    SHA512

    aef1d70d261ff2f05536e50bbb3274681c1f4357190c29b69b68913a75121e28bae61b19cead0e8a170f23815fbf092896117ab857ae6188d132aac182ae0d73

    Download Submit

  • C:\ProgramData\jNl06511kGoEo06511\jNl06511kGoEo06511
    Filesize

    192B

    MD5

    fdd7fd0af0861c7cbef0fcdb912ab51b

    SHA1

    d1939f0cb026de0de9f8506fca1beeffac8f525c

    SHA256

    ec3013f5b284757e3a1293fdefec6c9375b16414963b8d65562749dc811e5f11

    SHA512

    3c866b6d91297b8d4d608670ef8b79d7a50a78eeac8477bfa93c3e7a05a42e28b55c04eb06daa1a979c0ca5a1a64422427145ede578ad2660923519729a2e520

    Download Submit

  • \ProgramData\jNl06511kGoEo06511\jNl06511kGoEo06511.exe
    Filesize

    357KB

    MD5

    295b60af19205e1b7278475fd4c753d1

    SHA1

    2ac9ac189002691db53513d8b8004e32507a35d3

    SHA256

    707ee1b271c794009f3e47a19ce61f1aebedeae42b653ee1a3e9ffbcc1eb602c

    SHA512

    392998bfbea6d17783c4dd34e9516785152ec285cf5b1a3cdebf93e328d34292bfc8608ea006954fa913f3791ad63d847b3e2de71de80f29c4ea3a237466fee9

    Download Submit

  • memory/836-24-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

    Download

  • memory/836-25-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

    Download

  • memory/2732-37-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

    Download

  • memory/2732-38-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

    Download

  • memory/2732-47-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

    Download

  • memory/2904-6-0x0000000077B0F000-0x0000000077B10000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2904-5-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

    Download

  • memory/2904-23-0x0000000002290000-0x0000000002364000-memory.dmp

    Filesize

    848KB

    Download

  • memory/2904-29-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

    Download