Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

1415517992...18.exe

windows7-x64

10

1415517992...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2024, 16:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    14155179926713b5c2a9c61a1b89a055_JaffaCakes118.exe

  • Size

    32KB

  • MD5

    14155179926713b5c2a9c61a1b89a055

  • SHA1

    5e7b85c9fc39892974d68f1d2f4e9326660a40e3

  • SHA256

    d6975169935130df15684d2f21c6e12d5748f2423d4e18b92af88fbe9c0bb7dd

  • SHA512

    1681a9ffcb4de9baf8973f091d81bc57def6ff1dac5b0b90b5d6b1f02a3723fd2afbf6a9919a4e0037775eb14c6991e4f3674729b33f959ff91bafeba7541428

  • SSDEEP

    768:QhzsIdmoIBW+J1aLu+iANtg9bPHhHXPNWNCB+Gc1H8zHvc:QJsIdmoIBW+faS2tg9zxB+52Dvc

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14155179926713b5c2a9c61a1b89a055_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\14155179926713b5c2a9c61a1b89a055_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\Admin.exe
    Filesize

    32KB

    MD5

    0e6ef18a1438ad05cbb3416ed68edf30

    SHA1

    83f2968d5f7ca74838f9b4634d67861e0cdc7e68

    SHA256

    8d8f94dbe6d4bd2f80f6fb15948703e2997fb6144a3110706ad68f0e7817fe9d

    SHA512

    4121fdd296d9d4dbfc37d8223d28f996bae0eb64031158a8f2051e9ed110b459091afa80641b7db1c6d63c1f1c1c8b83586e59432886e4385c6311b37d6d446e

    Download Submit

  • memory/2308-0-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2460-13-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download