Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    08/10/2024, 20:38

General

  • Target

    251fc88ffb763925fc860ffde94cf9b0_JaffaCakes118.exe

  • Size

    356KB

  • MD5

    251fc88ffb763925fc860ffde94cf9b0

  • SHA1

    b1c31c6d2069c2fbb8830d331bf278a3348e1c94

  • SHA256

    25f714d1afcc851fe3761d40d639375eefc64bf03e7423d3d75de76fbd52c159

  • SHA512

    fb73edfb48a194b3144fbae984cc4dbaca340062ee4dc951e038f10b857a90bdec9bbdcd02c321bf53045519f486c74ecdedec7f65fc15862033475b439a94ec

  • SSDEEP

    6144:7vbx8O8A+buvc1zO7ySeIObnOY0o0MDJMR5VoIP2T4LWE9maZY:7/LoMeXAMCR5VoI2w9maZ

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\251fc88ffb763925fc860ffde94cf9b0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\251fc88ffb763925fc860ffde94cf9b0_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Users\Admin\AppData\Local\Temp\251fc88ffb763925fc860ffde94cf9b0_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\251fc88ffb763925fc860ffde94cf9b0_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\ProgramData\PzBBoZaHOx\iudAHyI3bEw78.exe
        "C:\ProgramData\PzBBoZaHOx\iudAHyI3bEw78.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:816
        • C:\ProgramData\PzBBoZaHOx\iudAHyI3bEw78.exe
          "C:\ProgramData\PzBBoZaHOx\iudAHyI3bEw78.exe"
          4⤵
          • Deletes itself
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Program Files (x86)\Internet Explorer\ieinstal.exe
            "C:\Program Files (x86)\Internet Explorer\ieinstal.exe" /i:2068
            5⤵
              PID:2756

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \ProgramData\PzBBoZaHOx\iudAHyI3bEw78.exe

      Filesize

      356KB

      MD5

      251fc88ffb763925fc860ffde94cf9b0

      SHA1

      b1c31c6d2069c2fbb8830d331bf278a3348e1c94

      SHA256

      25f714d1afcc851fe3761d40d639375eefc64bf03e7423d3d75de76fbd52c159

      SHA512

      fb73edfb48a194b3144fbae984cc4dbaca340062ee4dc951e038f10b857a90bdec9bbdcd02c321bf53045519f486c74ecdedec7f65fc15862033475b439a94ec

    • memory/816-32-0x00000000754D0000-0x00000000755E0000-memory.dmp

      Filesize

      1.1MB

    • memory/816-36-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/816-37-0x00000000754D0000-0x00000000755E0000-memory.dmp

      Filesize

      1.1MB

    • memory/2068-55-0x00000000754D0000-0x00000000755E0000-memory.dmp

      Filesize

      1.1MB

    • memory/2068-53-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2068-41-0x00000000754D0000-0x00000000755E0000-memory.dmp

      Filesize

      1.1MB

    • memory/2224-25-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2224-10-0x00000000754D0000-0x00000000755E0000-memory.dmp

      Filesize

      1.1MB

    • memory/2224-27-0x00000000754D0000-0x00000000755E0000-memory.dmp

      Filesize

      1.1MB

    • memory/2224-2-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2224-7-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2224-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2224-5-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2224-8-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2432-0-0x00000000754E1000-0x00000000754E2000-memory.dmp

      Filesize

      4KB

    • memory/2432-6-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/2756-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2756-52-0x00000000754D0000-0x00000000755E0000-memory.dmp

      Filesize

      1.1MB

    • memory/2756-56-0x00000000754D0000-0x00000000755E0000-memory.dmp

      Filesize

      1.1MB