Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18/10/2024, 09:32

General

  • Target

    56afcf6bb447f3f8d1d8bf1e4c88db50_JaffaCakes118.jad

  • Size

    82KB

  • MD5

    56afcf6bb447f3f8d1d8bf1e4c88db50

  • SHA1

    caaffd0cbee67bf5026ca584330bb23fbb03c775

  • SHA256

    2f7838c68cb203378ef5ecfc94c6ca077ead1c096f602510796ba257b74e1384

  • SHA512

    e78abb29eff92a82adde14225b2431d2ee8054781bf2840c75d5551cff5e117b2c419803db384a344e70ce3d50ac13aee0e693204300d20a609b3f484149d92f

  • SSDEEP

    1536:WBsjwkvMpBTcwN+gbR/5ogqxMm5pPa3ivZqb49kIpWdlcK5nSdIw5k81iDh:WBsjwdP5ZRSgqri3ivG49Xwlz5KIw56

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\56afcf6bb447f3f8d1d8bf1e4c88db50_JaffaCakes118.jad
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\56afcf6bb447f3f8d1d8bf1e4c88db50_JaffaCakes118.jad
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2064
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\56afcf6bb447f3f8d1d8bf1e4c88db50_JaffaCakes118.jad"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    8476b8b94f6ee386474df4f105d4c562

    SHA1

    6acb0d688a40a1d652db113ef520ef0fba4c9de0

    SHA256

    3cb7cfdc8ef5a5022ba8785825aca1e0ee8593f170560ac629498c8d93185bfc

    SHA512

    75fa6f299b0fe29464d50c2906d4a05071bbfe061315e14371c94f24af437365b3b1dc1dbb7295d22ed6560089addbec6925afad92fb1be0fb05949f379296b0