Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2024, 19:21

General

  • Target

    14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe

  • Size

    280KB

  • MD5

    14a1837a69256daa3089f241a54767bb

  • SHA1

    9250b6882f1105c159c17ae221249f7ef6c721e3

  • SHA256

    604943ffeae818c064d8da3e9d9a651f2b04d15137a4fdfeffc2486dc1752e25

  • SHA512

    8a2053a48fb0c79fd990bbae5917658a5e3e5b06ca9bcbe2c2280a03450ed68877e973959d596fc44f5a3d8ebb0aeb08e3023da990390c63d9e815ca7a4a5ca7

  • SSDEEP

    6144:psaocyLC0HU6MED7c29CxANmAmevetoduog0PV1fHbf:ptobbdMi42AxwmAu5og0bb

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Users\Admin\AppData\Local\Temp\nstA575.tmp\installer.exe
      C:\Users\Admin\AppData\Local\Temp\nstA575.tmp\installer.exe 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe /t /dT132281210S /e5843895 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Users\Admin\AppData\Local\Temp\nstA575.tmp\4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe
        /t /dT132281210S /e5843895 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nstA575.tmp\4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe

    Filesize

    249KB

    MD5

    e5fdaf113b510ceaf5672d7af36eaa75

    SHA1

    ee4c3b6d2343650926944869a07e31a9a2a4ffc5

    SHA256

    d4f2a25d2831f368313160bf2e2983264426ba9e4027447440b5a3ee8bb8b526

    SHA512

    f55acf149353251d44d768381a9256f509c62e24479775a24924c584a29fd7cdc2f705b84318a0280ca9731c6c3b4be993045e2e925cd42ef7a9e64e21e584a8

  • \Users\Admin\AppData\Local\Temp\nstA575.tmp\installer.exe

    Filesize

    207KB

    MD5

    de8e9cb3a534359f5809b9c5980ce365

    SHA1

    34def3bd6d46a97daa546671513733b9a94c1e8a

    SHA256

    653db07daeedb23437e723f00ab4f7320e5bb6e6689e38e54896ee44d84cfc71

    SHA512

    dffe030837a4babfb06419ffd893f54b9856e0f1aafb320e923a7a4aea894154207b0f2998fd0ecaaf0105c6ff1bed95d93a8ae2f531e1c8c3aca248a35b1fe2

  • \Users\Admin\AppData\Local\Temp\nstA575.tmp\nsExec.dll

    Filesize

    8KB

    MD5

    249ae678f0dac4c625c6de6aca53823a

    SHA1

    6ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201

    SHA256

    7298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce

    SHA512

    66e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7

  • memory/1636-30-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2188-21-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2188-16-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2188-14-0x00000000021E0000-0x0000000002208000-memory.dmp

    Filesize

    160KB

  • memory/2188-26-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2188-13-0x000007FEF5E0E000-0x000007FEF5E0F000-memory.dmp

    Filesize

    4KB

  • memory/2472-23-0x0000000074622000-0x0000000074624000-memory.dmp

    Filesize

    8KB

  • memory/2472-22-0x0000000001FD0000-0x0000000002010000-memory.dmp

    Filesize

    256KB

  • memory/2472-24-0x0000000074620000-0x0000000074BCB000-memory.dmp

    Filesize

    5.7MB

  • memory/2472-25-0x0000000074620000-0x0000000074BCB000-memory.dmp

    Filesize

    5.7MB