Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2024, 21:44

General

  • Target

    643826b5b9cb0926063e65c74de37c49_JaffaCakes118.exe

  • Size

    228KB

  • MD5

    643826b5b9cb0926063e65c74de37c49

  • SHA1

    72d221739090d6eb7c37974e3ed5ce3249f02d6e

  • SHA256

    dbc5ffc9c3cffbc65ab30d684dd6e025f95e89b2fb0f71c2f82f9fe534a0a911

  • SHA512

    9fc6679f1db528aac2d9cbac565ff1fe857253fb348c64583a1bced5f68c519b162e0001bb0736954db53e0c9f0394b7f9d413d9fa60041246bbf92787a69f80

  • SSDEEP

    6144:86D4YEhZJTRwYpQg1h9zQDnYKqXLxdIXHec2:84AzPzQDnwLo+c2

Malware Config

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\643826b5b9cb0926063e65c74de37c49_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\643826b5b9cb0926063e65c74de37c49_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Users\Admin\AppData\Local\Temp\643826b5b9cb0926063e65c74de37c49_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\643826b5b9cb0926063e65c74de37c49_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Windows\syswow64\explorer.exe
        "C:\Windows\syswow64\explorer.exe"
        3⤵
        • Drops startup file
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2980
        • C:\Windows\syswow64\svchost.exe
          -k netsvcs
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2836
        • C:\Windows\syswow64\vssadmin.exe
          vssadmin.exe Delete Shadows /All /Quiet
          4⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2904
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2144

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab4108.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar41F5.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1176-4-0x0000000000400000-0x0000000001400000-memory.dmp

    Filesize

    16.0MB

  • memory/1176-19-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/1176-7-0x0000000000400000-0x0000000001400000-memory.dmp

    Filesize

    16.0MB

  • memory/1176-12-0x0000000000400000-0x0000000001400000-memory.dmp

    Filesize

    16.0MB

  • memory/1176-16-0x0000000000401000-0x0000000000418000-memory.dmp

    Filesize

    92KB

  • memory/1176-10-0x0000000000400000-0x0000000001400000-memory.dmp

    Filesize

    16.0MB

  • memory/1176-6-0x0000000000400000-0x0000000001400000-memory.dmp

    Filesize

    16.0MB

  • memory/1176-1-0x00000000001B0000-0x00000000002AA000-memory.dmp

    Filesize

    1000KB

  • memory/1176-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1176-15-0x0000000000400000-0x0000000001400000-memory.dmp

    Filesize

    16.0MB

  • memory/1176-18-0x0000000000400000-0x0000000001400000-memory.dmp

    Filesize

    16.0MB

  • memory/2104-0-0x0000000000310000-0x0000000000314000-memory.dmp

    Filesize

    16KB

  • memory/2836-24-0x00000000000C0000-0x00000000000E5000-memory.dmp

    Filesize

    148KB

  • memory/2836-25-0x00000000000C0000-0x00000000000E5000-memory.dmp

    Filesize

    148KB

  • memory/2836-74-0x00000000000C0000-0x00000000000E5000-memory.dmp

    Filesize

    148KB

  • memory/2980-20-0x0000000000080000-0x00000000000A5000-memory.dmp

    Filesize

    148KB

  • memory/2980-17-0x0000000000080000-0x00000000000A5000-memory.dmp

    Filesize

    148KB

  • memory/2980-73-0x0000000000080000-0x00000000000A5000-memory.dmp

    Filesize

    148KB