Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    65s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2024, 15:21

General

  • Target

    13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe

  • Size

    198KB

  • MD5

    13e42b0bcd4ec6702d2ff4ce5f5b1ccd

  • SHA1

    cdbb772997cd8f79b889ad790b1a3e326ae69b1b

  • SHA256

    82029f82fde8b78c4b0313a58d89c32a078fc18f565cc4ebc4b0ab30d340b675

  • SHA512

    e773fcc81d6a547f9910c107a47e6edeedfa5666397a26e2ca0f9a25b471ab247e8545d44949ab87263d5a30fd2c707af0fd8fa33f3b041529a73f10a2ecd949

  • SSDEEP

    3072:fBivIGKtx6KXqK5hLkYX9aZCwFNEFQCqqXsUNq4WXeY6+vvDDRrs+eq:UIGK/EKLnuCwzFUNqhOYzt

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 2 IoCs
  • Unexpected DNS network traffic destination 9 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:476
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Executes dropped EXE
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:1336

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-18\$13dae7fa63ea489d4dbbfe46431825e3\@

    Filesize

    2KB

    MD5

    a091a65820a19a7002a2e91dc520b959

    SHA1

    381c8d5c8f39d482e83b0fbbf60f8923921fb28e

    SHA256

    dd27a656704f65b4ddf1d1445b1d695e14d942e90f13c98d91d0f087d4714f67

    SHA512

    f2d0cb6eb51ab8a11225cdbd68e9d05103feefefffbe440bef4dbba152375ea9a9b8dbc5532c2e857719ee687d0d651ac0e7bea1f2a4740e483a84ad2bd15681

  • C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\$13dae7fa63ea489d4dbbfe46431825e3\n

    Filesize

    41KB

    MD5

    fb4e3236959152a057bc6b7603c538ef

    SHA1

    b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

    SHA256

    8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

    SHA512

    993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

  • memory/476-13-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/476-22-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/1192-21-0x00000000024E0000-0x00000000024E1000-memory.dmp

    Filesize

    4KB

  • memory/1192-4-0x00000000024E0000-0x00000000024E1000-memory.dmp

    Filesize

    4KB

  • memory/1192-9-0x00000000024E0000-0x00000000024E1000-memory.dmp

    Filesize

    4KB

  • memory/3044-3-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/3044-1-0x000000000042E000-0x0000000000435000-memory.dmp

    Filesize

    28KB

  • memory/3044-20-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/3044-19-0x000000000042E000-0x0000000000435000-memory.dmp

    Filesize

    28KB

  • memory/3044-2-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/3044-0-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB