Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2024, 04:26

General

  • Target

    45d508623e4c941d49c93bc2fa31cc9f_JaffaCakes118.exe

  • Size

    792KB

  • MD5

    45d508623e4c941d49c93bc2fa31cc9f

  • SHA1

    d7b5f742e4fd8a41903f30d7d17b5b76b53b9fd1

  • SHA256

    acbd8c321db688c7cb88ccc73ac31bd93bbe795ebcd76f0eed4c036955c7e1b0

  • SHA512

    00362f2f8927d875ac5d07e3d24929fc5b4f86a60f0c5d140bc66c32d1c2b902d4346a3a659927e0de867fc7a38820a5452ab4acab47c91f21dc6c4278c82bde

  • SSDEEP

    12288:2RvAgCYxPVQ1KRLLIyDASbumfbKFsdrojwSzunLEjzaQ/K1V+qrEK6FWIdRAKlJ:WAgCYQ1LGum4sx8Kofd/uV+wEK6FWKd

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45d508623e4c941d49c93bc2fa31cc9f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\45d508623e4c941d49c93bc2fa31cc9f_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:816
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:662050 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\45d508623e4c941d49c93bc2fa31cc9f_JaffaCakes118.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-1846800975-3917212583-2893086201-1000"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    566KB

    MD5

    3fe7c92dba5c9240b4ab0d6a87e6166a

    SHA1

    7980d7dffc073515b621834246dda33ab00c308d

    SHA256

    a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258

    SHA512

    bd2c87b2d02b80b90f744a101bbb9294b1d90650a338be725028e6649e46a759fa72032e80ffe911ae82b005b4d2394960e7b73ce7ad8fe3a70e8a47d2a7c98d

  • memory/816-13-0x0000000002A50000-0x0000000002BD1000-memory.dmp

    Filesize

    1.5MB

  • memory/816-15-0x0000000002A50000-0x0000000002BD1000-memory.dmp

    Filesize

    1.5MB

  • memory/2800-16-0x0000000000400000-0x0000000000581000-memory.dmp

    Filesize

    1.5MB

  • memory/2800-29-0x0000000000400000-0x0000000000581000-memory.dmp

    Filesize

    1.5MB