Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2024, 06:21

General

  • Target

    463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe

  • Size

    731KB

  • MD5

    463d924f023e80c3850d2b1c8561ad2b

  • SHA1

    e0a8c887b51ec16a40ece73eeb333265e36fb60a

  • SHA256

    cea4e5f486fc3c2ee078e2a0d2256b97187ec772b1e291847d32e6fe8d095380

  • SHA512

    a994ccbdb44389cfe769d6f2b871ddf78632713d987dbf37d725d51c4ea15de676c18eff5a0530d45a9ea4108cdf5eec9a2234ccb3723dcb0b03b73b3ec1fdd6

  • SSDEEP

    12288:g8L25c+ugtP0AF9jh0zzF9zl04skRICpwPz/0wi6AoCPY1urkh//spebIl6nMfSF:gGr+hiAF9gR0aPpC/FAoCPY1urkh//sW

Malware Config

Signatures

  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 29 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Downloaded Program Files\kazaa participation hack.exe

    Filesize

    733KB

    MD5

    87eda58fce108e934df6e0158af84ab8

    SHA1

    3e2103a7d2f68ca02a73ec9abff1b75e864d6294

    SHA256

    a6956bd3b402b51a19636b2570f1e6a249ea8cd14d3d3a4d823d158b8b42a939

    SHA512

    9ab0ade8e8a8aaf0dd7fe111e6a6684bef687f390fb554c32a409fa77958893237a594f26a65d3dcb58a815e0adabe5390f9ec9b4cf70d6c509aae67430c43c6

  • C:\Windows\system\SystemNetBBS.dll

    Filesize

    4KB

    MD5

    df336060e55b58fb1f4b8aad0ca0c3af

    SHA1

    c150c7f5cc49b00aee54033ec8dce212db7504fd

    SHA256

    65bf259f46db84aca25ad4925a785b454569b68d9ce1610961d65d8afcc8fc96

    SHA512

    a10e2676b179aee95a691a68a7481038707b49679d748590930ef751951b759cbea5021e6152fd2ee701e3be8ef57b87c9b085364633cd987cc70b22d320f0e2

  • C:\Windows\system\SystemNetBBS.dll

    Filesize

    3KB

    MD5

    50594c36d70bcd26fb461e7c3ff2699d

    SHA1

    22a1f730d4f645f24870f58784053f923f311d52

    SHA256

    b8b383a2b53584ab01c2b536b69f52b0e816fc50f1ed723a095439016c1c1c66

    SHA512

    ed18fa771af506e98bbc557589c6f58f2418263eaf273fd646b14ffa92d957d9286d1722e3c4378a6b46c3365b9f87bf56892752ea511c20bc1e216f3de8630c

  • C:\Windows\system\SystemNetBBS.dll

    Filesize

    177B

    MD5

    25a174bf79e30879367088aaf4f5d7fb

    SHA1

    b55306fe67fccfa081ac1534fadfa0af7bed6c35

    SHA256

    d723e6215942b8375437043ce5bb642a68b1652796ec096003b0ae0963c75554

    SHA512

    61c612fac223d7b907101b022fe4003bbef039ce41f4fa63d0f4fe5aecfc63982dbd34da27e8ed15321381360a01255e990f4bce806c85277ecd6aae27f9f5c7

  • C:\Windows\system\SystemRunInternet.dll

    Filesize

    543B

    MD5

    d6ead8f5496720f1f37b7a85f32b2884

    SHA1

    f89eb47a6581e7f931083ad8f0f72516f79a1499

    SHA256

    28070d14406359723bd0b0caa008bb6de70fcc853425be004e6d61d2c7f4581b

    SHA512

    a742c33ee031b1edcb73417cf06918bb351e2550d2951d6fc530fd12ebebe4a4e1741bc5096e3400098b46923aeca8d12dccfbda7c6d503286440138a384df41

  • C:\Windows\system\SystemRunInternet.dll

    Filesize

    909B

    MD5

    163e555421aab9e0750757f7de7c70a3

    SHA1

    f4198d764c735518fe607cd4f4815b800607c305

    SHA256

    3da32a3e3e3f0149914933cca6a5ecd29776cda95eb43cacd167ac7b130e8f20

    SHA512

    4532c46c417ea5fddabd9aefe30f553ae8a133630262759a3da931c7a776f7b1af4da283d9a3fc024d50e2315e6bb4394687ebe8eff903ced80d81a9f536b0b2

  • memory/2296-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2296-1912-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2296-1911-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/2296-1920-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB