Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17/10/2024, 02:05

General

  • Target

    504524a434585bae6bc9fa6c896456bd_JaffaCakes118.exe

  • Size

    110KB

  • MD5

    504524a434585bae6bc9fa6c896456bd

  • SHA1

    51c1143c43482b327e2e5e949d6756a59c2f6d90

  • SHA256

    94c8b6d51a8a39a93d29174a1be96f684aec2e46d4a7bb75df001711418677f6

  • SHA512

    ea44bc695c623312b08641e2055410c176bf9891f47f41c47dff9422e5349a349b3864f64862e7590961471653d673fddbbb0ac5411389296f2e7c01592d914f

  • SSDEEP

    1536:z1LizXiTVN5Pmzcvjt12DU1WYXO7ardmVTBqQxp8kQDndiTGk:zwbin5P5EDU1WSEWm5AQ/8kQndov

Malware Config

Signatures

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\504524a434585bae6bc9fa6c896456bd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\504524a434585bae6bc9fa6c896456bd_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Users\Admin\AppData\Local\Temp\504524a434585bae6bc9fa6c896456bd_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\504524a434585bae6bc9fa6c896456bd_JaffaCakes118.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:884
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\otSWi.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\otSWi.vbs

    Filesize

    408B

    MD5

    1dfca4a085536d0351398141ec4ad428

    SHA1

    8fb8cb61367c01807426c681633d77a086b6980f

    SHA256

    0be4987a21b264b8ff1f7b926d2204b9e4c6b85e76c311b9b2f923376207aa48

    SHA512

    5d52ac8355ac97f06860694e467f0b85c0a200d4bc84a50c2a808fbfcecbeda1f0b27af359ded52595ef630c3e4e2d813ce03e6327633d7316fdff8e1dc4d91a

  • memory/884-5-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/884-19-0x0000000074DF0000-0x000000007539B000-memory.dmp

    Filesize

    5.7MB

  • memory/884-17-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/884-15-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/884-13-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/884-9-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/884-27-0x0000000074DF0000-0x000000007539B000-memory.dmp

    Filesize

    5.7MB

  • memory/884-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/884-7-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/884-3-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/884-22-0x0000000074DF0000-0x000000007539B000-memory.dmp

    Filesize

    5.7MB

  • memory/2756-0-0x0000000074DF1000-0x0000000074DF2000-memory.dmp

    Filesize

    4KB

  • memory/2756-1-0x0000000074DF0000-0x000000007539B000-memory.dmp

    Filesize

    5.7MB

  • memory/2756-26-0x0000000074DF0000-0x000000007539B000-memory.dmp

    Filesize

    5.7MB

  • memory/2756-2-0x0000000074DF0000-0x000000007539B000-memory.dmp

    Filesize

    5.7MB