Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2024, 14:43

General

  • Target

    30689d5387b5fcf72042e91e7e0e9bfe_JaffaCakes118.exe

  • Size

    272KB

  • MD5

    30689d5387b5fcf72042e91e7e0e9bfe

  • SHA1

    8ad20a9b0a71cfc6b2e6c303971d57128daf79d0

  • SHA256

    9bb9c3895e3b3881593bc95f58efe149ef15439ed5b53c2d9387f83e5ce1bb8b

  • SHA512

    47963523f8af9f7b7fb6a20bb9356a7503d717346a6280bb9d4c84e4a727849f235aefe32743818e89868c2ce2e9860c9d317843f41607e0dfe7596d9ad14c4f

  • SSDEEP

    6144:Q6Q4uYV6jvSDxs36+7HqPFpawolmR8e2bLqU/i:Q6Q4/V6Tos36+7HAzawBR8P+r

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\30689d5387b5fcf72042e91e7e0e9bfe_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\30689d5387b5fcf72042e91e7e0e9bfe_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Windows\Drymia.exe
      C:\Windows\Drymia.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Drymia.exe

    Filesize

    272KB

    MD5

    30689d5387b5fcf72042e91e7e0e9bfe

    SHA1

    8ad20a9b0a71cfc6b2e6c303971d57128daf79d0

    SHA256

    9bb9c3895e3b3881593bc95f58efe149ef15439ed5b53c2d9387f83e5ce1bb8b

    SHA512

    47963523f8af9f7b7fb6a20bb9356a7503d717346a6280bb9d4c84e4a727849f235aefe32743818e89868c2ce2e9860c9d317843f41607e0dfe7596d9ad14c4f

  • C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job

    Filesize

    372B

    MD5

    769bddc32e9941bae8c87065ebaa1c7f

    SHA1

    fb80cf94564f8afa8668cc238b98d29ed617a960

    SHA256

    df4ab56e6e087146a7e9b9acd5314419405aa82f769688ff5ac01568f847896b

    SHA512

    963c58109475960a8376739b378b815e2b3c80b343d552cc97af3849e8fc04b67f32d6b667485cef95b7523f832a6eca008a63571183847df405db0683161a67

  • memory/2572-1-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/2572-0-0x0000000000620000-0x000000000063B000-memory.dmp

    Filesize

    108KB

  • memory/2572-68997-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/3040-73852-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/3040-9-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/3040-73851-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/3040-8-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/3040-73853-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/3040-73854-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/3040-73856-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/3040-73858-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/3040-73859-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/3040-73863-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/3040-73864-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB