Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2024, 22:43

General

  • Target

    64713b6d231e03e1321e8afd9ef7cddc_JaffaCakes118.exe

  • Size

    6.2MB

  • MD5

    64713b6d231e03e1321e8afd9ef7cddc

  • SHA1

    80999778729814821415559fa3bf4a0b06211750

  • SHA256

    3a838d77489e2e60c77d1bf82a0d7a82a02ed1ba9c1bf1441cbe8c64eb348de5

  • SHA512

    c0f4cc345744b4031e154cc739cbf007cab4f5648b199d0bbc1bc39a8ecd6a0126ab795ce14cbcb950ca6dafc68ab11559e10fe194b29375c5b4a13e100bb2c1

  • SSDEEP

    24576:TEtl9mRda1XySGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJs:oEs1Xne

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\64713b6d231e03e1321e8afd9ef7cddc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\64713b6d231e03e1321e8afd9ef7cddc_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:2272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.exe

    Filesize

    6.2MB

    MD5

    0c02a5c1323e3b3e9076a9c152dc8ec6

    SHA1

    19fa7c54d79908607934b2548e7e4cce57c52203

    SHA256

    1529592d5156ff50a8d2f727ac9c528678d02101de2511c6a9f0d96813210765

    SHA512

    0a1f727183c458dfeaa6cf4ea1f89c3196a93f283d5fc88649796f3560373daad139db90bcdd1f87aa0e8a38f0393304a866b9867517291530a5f448fc054194

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    6913fb3d3d7058476a4231f5c0c5a1a9

    SHA1

    0f5b575135d48b310e7ce7bfa68f8a92d59ef50c

    SHA256

    8d00e563309933112377de586c02b4c6a759b5327e33f21bcf47fd3eb619959b

    SHA512

    aa3fd081f33983fbe34370c41949e564a79296ff9ef888ed621ff0c948f852386b8c86c56180a5f67f44dea621d3a7b73f23952f93a6f3b683cb36a007c3c91a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    950B

    MD5

    b09a8906642e399315154b5f62873a47

    SHA1

    71fde4cc4e5e7e572695296d626ed5d49e7a59e3

    SHA256

    dd4f798333514c9850527d5efba9c4109e6624c916481945dd5edac515c15aad

    SHA512

    4b8d8db295272b385ad7150a076543e0a5a312b86a7e085f6f084d79b0f52cf329fdfeb4d48aa1a353f633861482b3d0372143c78a1433ff5e625b890665e39c

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    6.2MB

    MD5

    64713b6d231e03e1321e8afd9ef7cddc

    SHA1

    80999778729814821415559fa3bf4a0b06211750

    SHA256

    3a838d77489e2e60c77d1bf82a0d7a82a02ed1ba9c1bf1441cbe8c64eb348de5

    SHA512

    c0f4cc345744b4031e154cc739cbf007cab4f5648b199d0bbc1bc39a8ecd6a0126ab795ce14cbcb950ca6dafc68ab11559e10fe194b29375c5b4a13e100bb2c1

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    4.8MB

    MD5

    3bf6297fe0be5002a90e7c00a4aa83a7

    SHA1

    b485aed1d38feb864d4f15ffa1a469ff9ad83860

    SHA256

    994c585272c68e5bdb15aeb2390ac6e6c16dd98ce04ecc3fec4f0e28dd076022

    SHA512

    def5ef0b60cdedc83d75b890a0352b8421e5cdc94d07e9c3bf3e256e4f2934dd357c003935246ce4a07252677d502f6b8f80addc8995ff024918e55f53209fd1

  • memory/1744-75-0x0000000001E20000-0x0000000001E9B000-memory.dmp

    Filesize

    492KB

  • memory/1744-10-0x0000000001E20000-0x0000000001E9B000-memory.dmp

    Filesize

    492KB

  • memory/1744-72-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/1744-0-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/1744-230-0x0000000001E20000-0x0000000001E9B000-memory.dmp

    Filesize

    492KB

  • memory/1744-9-0x0000000001E20000-0x0000000001E9B000-memory.dmp

    Filesize

    492KB

  • memory/1744-1-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/2272-13-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2272-12-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/2272-231-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/2272-236-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB