Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2024, 21:29

General

  • Target

    3c1f2075d0ef2a08501c9cac019a307e_JaffaCakes118.exe

  • Size

    110KB

  • MD5

    3c1f2075d0ef2a08501c9cac019a307e

  • SHA1

    69864dfad7b871ea81f74cb76a240fe2c4d0f053

  • SHA256

    09a09d56d898d8990f0bc92ccf64424f7480252f2700fc90a0c55e1d92e01e16

  • SHA512

    9ca977b4036d77321099ae7169d694bd197cb6a2da3613d25207cd878d0443e69c7ae19850d4ed85ef4ea4379cc0617061ce9a969e6777739c660d117adb325d

  • SSDEEP

    768:h2sLL2ReHY7qCVmByFXoZk02i14lzg+HkvaoKUgPfTeqGqbjX1ay3Iun136nt:h3L2R8upEmmOlzgCkvNcPfT6q/kyDn

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c1f2075d0ef2a08501c9cac019a307e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3c1f2075d0ef2a08501c9cac019a307e_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2608

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\a..bat

    Filesize

    238B

    MD5

    cc3606944744f289934aba9ed7b8aaea

    SHA1

    681a4b6f3b9b5f823670019eac62d1d67ff34934

    SHA256

    20857e0d27be313923f2fa8c1685b3dcb8753a958728cb646621341420a068a6

    SHA512

    2e69e85d60da52732b618f8d837504a86831e8aa3da604dfc0d1e1eefc26f1453e649b75add48139e249fe1341bbab264f930ff6129bad7ce17ce6873ac2e7fe

  • memory/2008-0-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/2008-3-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB