Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 03:08

General

  • Target

    29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe

  • Size

    543KB

  • MD5

    29be3eeb50ed2625cb6a20a7f3ecbd56

  • SHA1

    3c5e3f92512753925f739a92b5f702266da3ff63

  • SHA256

    62d095977f9199066dc87d6c8bbe2c7b1b668a5e74b24dda57e2593b35f48930

  • SHA512

    6b166f3e5c55b54526e3721d570783f3426af62e748752d7305ab15325ea0f06e719ce6f3159fbe19aecd46b42302447fa2e6a01516203586680614d9a3583a4

  • SSDEEP

    12288:/uog2wdOQ4MFhNSZSBPONjXBeyl6DW7w2pKuyelP3LOwHJ7kt/n:/jiccqSsXQy0cVCe5LOoJAtv

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Users\Admin\AppData\Local\Temp\DM\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe\GW2fBZRrcea4tPd\Launcher.exe
      C:\Users\Admin\AppData\Local\Temp\DM\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe\GW2fBZRrcea4tPd\Launcher.exe /in="e29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe" /out="29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe" /psw="791833e313b44c6192aff883ac015670" /typ=dec
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1228
    • C:\Users\Admin\AppData\Local\Temp\DM\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe\GW2fBZRrcea4tPd\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\DM\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe\GW2fBZRrcea4tPd\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe /path="C:\Users\Admin\AppData\Local\Temp\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:3024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DM\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe\GW2fBZRrcea4tPd\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe.config

    Filesize

    690B

    MD5

    bca0ea75b6940aa86960d7b9098a5998

    SHA1

    3d57f82158ac72c7eb2e72ba19a80485d8103130

    SHA256

    5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

    SHA512

    260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

  • C:\Users\Admin\AppData\Local\Temp\DM\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe\GW2fBZRrcea4tPd\Launcher.exe.config

    Filesize

    340B

    MD5

    91629f6b28cbe2b52bb86cb5af3bdbca

    SHA1

    35fb57ac58c9eb0668f5832a588d9f81e040568b

    SHA256

    589c122996fadc118731c6f983c5d3b498c4b4b59700ea548f4cfb79e4eaaeeb

    SHA512

    f08382296696173784841a163c73c19e7bd674a08a053c0434d55696f45039721925e5d829e4bbbf71b07385d1b88c5ea241b8247eb0d81bf381205977bd14c5

  • C:\Users\Admin\AppData\Local\Temp\DM\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe\GW2fBZRrcea4tPd\e29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe

    Filesize

    395KB

    MD5

    f47b3668c39480bf325d624e8e82a3aa

    SHA1

    f94c4c4f3394af98b4c2414248ef286d8e35a274

    SHA256

    1b0cb7f2ef6e50c5817b70bce93faa4fe34f98a9428dac83ce92492ee3d77534

    SHA512

    f235785cb8c8594625f7a99611fb64d0498ae7533a44c7e659afbd7c22e4a1684c64039ac2812e43f7b426eff347d4c753c8a246d46a4a922145074a4c087222

  • C:\Users\Admin\AppData\Local\Temp\DM\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe\GW2fBZRrcea4tPd\installer.exe

    Filesize

    543KB

    MD5

    29be3eeb50ed2625cb6a20a7f3ecbd56

    SHA1

    3c5e3f92512753925f739a92b5f702266da3ff63

    SHA256

    62d095977f9199066dc87d6c8bbe2c7b1b668a5e74b24dda57e2593b35f48930

    SHA512

    6b166f3e5c55b54526e3721d570783f3426af62e748752d7305ab15325ea0f06e719ce6f3159fbe19aecd46b42302447fa2e6a01516203586680614d9a3583a4

  • \Users\Admin\AppData\Local\Temp\DM\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe\GW2fBZRrcea4tPd\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe

    Filesize

    395KB

    MD5

    7e31bd0b262f0807863490ab8cefe41e

    SHA1

    3290e13884553614411bbcc36d455e12c6dbf275

    SHA256

    ba1979cadb35a1819f95b145f704c88fdb7399c4c8adddde5ef3e12c0dafc002

    SHA512

    1145b29f9adc46641a33723a577ad7f07f8d0bf8fcbd68bbc0a7769e4b336b7980b3062b76d28d8a70753a4a0d85a27c94cb5f7c91e006f933a13134caf73443

  • \Users\Admin\AppData\Local\Temp\DM\29be3eeb50ed2625cb6a20a7f3ecbd56_JaffaCakes118.exe\GW2fBZRrcea4tPd\Launcher.exe

    Filesize

    105KB

    MD5

    ba751ac19a4f8c60acc7685caf6a8cb7

    SHA1

    713f8e4f40717aced32555f604092ace8548cd34

    SHA256

    e72ec872fbd73f6e52419002ed7d656590c7926c65d91418efecbe3e19aae079

    SHA512

    e6187ced6fdcbcc8d6c03ab2657a92e5410fd752442ede82e6db5177d6d17a3c7ca330c817f39a3863c1b911411c33f1a5ebe50b208a5e3e56ad615e5b8dd5ca

  • \Users\Admin\AppData\Local\Temp\nsy951F.tmp\NSISdl.dll

    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • \Users\Admin\AppData\Local\Temp\nsy951F.tmp\pwgen.dll

    Filesize

    16KB

    MD5

    a555472395178ac8c733d90928e05017

    SHA1

    f44b192d66473f01a6540aaec4b6c9ac4c611d35

    SHA256

    82ae08fced4a1f9a7df123634da5f4cb12af4593a006bef421a54739a2cbd44e

    SHA512

    e6d87b030c45c655d93b2e76d7437ad900df5da2475dd2e6e28b6c872040491e80f540b00b6091d16bc8410bd58a1e82c62ee1b17193ef8500a153d4474bb80a

  • memory/1056-10-0x0000000000880000-0x0000000000881000-memory.dmp

    Filesize

    4KB

  • memory/1228-23-0x0000000073781000-0x0000000073782000-memory.dmp

    Filesize

    4KB

  • memory/1228-25-0x0000000073780000-0x0000000073D2B000-memory.dmp

    Filesize

    5.7MB

  • memory/1228-26-0x0000000073780000-0x0000000073D2B000-memory.dmp

    Filesize

    5.7MB

  • memory/1228-28-0x0000000073780000-0x0000000073D2B000-memory.dmp

    Filesize

    5.7MB

  • memory/3024-38-0x00000000001F0000-0x00000000001FE000-memory.dmp

    Filesize

    56KB