Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2024, 15:42

General

  • Target

    40b040f5ec946603cc65f8e596f31167_JaffaCakes118.exe

  • Size

    440KB

  • MD5

    40b040f5ec946603cc65f8e596f31167

  • SHA1

    604e23115be10c0bcdf5ddd30326db18575db5be

  • SHA256

    6db1c1d9c8d7f85e1ce1bff0c287510707d1aecabc11226a2c358d7f9e8afea8

  • SHA512

    ece11c87d77bf13a28d835a0e83f988a6c2c3cd7236fe4a620960c8d5c6e801c247db9313353510fb173ec45dc8423d39abf327c7f3c2847db811ea43875abe1

  • SSDEEP

    12288:2lFxJRcDqbcf+erao9ci+gSRqa409MB9Tlw1:2XwW25qxzg

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\40b040f5ec946603cc65f8e596f31167_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\40b040f5ec946603cc65f8e596f31167_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\ProgramData\oEmDgCp08400\oEmDgCp08400.exe
      "C:\ProgramData\oEmDgCp08400\oEmDgCp08400.exe" "C:\Users\Admin\AppData\Local\Temp\40b040f5ec946603cc65f8e596f31167_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\oEmDgCp08400\oEmDgCp08400.exe

    Filesize

    440KB

    MD5

    eee4a48e2d13616503a8855aa78715a0

    SHA1

    7f70d5d7f4b4af9141ebdfe338e149bbc98daebd

    SHA256

    d2a762ec70c0c83324dab553c5c489b598bfb982959c0d65cd65d5a831701685

    SHA512

    70a1b89e22bab1ff871b0ac469d6f8edb369adf276e890986fa09134bff4fe17b150009722f82488d4ca253a7d5395a58b5ff088d45cc0dbc5bfbfab73405e61

  • memory/2120-16-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

  • memory/2120-15-0x00000000005F0000-0x00000000006F0000-memory.dmp

    Filesize

    1024KB

  • memory/2120-17-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

  • memory/2120-24-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

  • memory/2120-40-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

  • memory/2440-0-0x0000000000570000-0x0000000000670000-memory.dmp

    Filesize

    1024KB

  • memory/2440-1-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2440-2-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

  • memory/2440-21-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2440-22-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

  • memory/2440-55-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

  • memory/2440-56-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB