Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

24/10/2024, 21:50

241024-1qcy8avemn 10

24/10/2024, 13:17

241024-qjty2sxeja 10

Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    24/10/2024, 13:17

General

  • Target

    73eb50d731889829becf58029a86eb45_JaffaCakes118.exe

  • Size

    28KB

  • MD5

    73eb50d731889829becf58029a86eb45

  • SHA1

    1c1b06f1b8a53fc3ccf365299251d32893a363d1

  • SHA256

    a2d4cc146cb1b62a7d4128b0e277c7411921cf9f77cc7577599a00697f3492b1

  • SHA512

    5e4348e1eef229728b4545d90a688ac48b55c55916501bb0c240f5c216e3eb6e65a75a051bc1400778684892d5cb609f3fd49c85d4cee13351a677db3b0ceda5

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyND52:Dv8IRRdsxq1DjJcqf3

Malware Config

Signatures

  • Detects MyDoom family 7 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73eb50d731889829becf58029a86eb45_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\73eb50d731889829becf58029a86eb45_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9b7d402a9adcdfa009ed329c76e722e5

    SHA1

    1a5a51e4558cb02d1a63c2dee8dec55bee9cca45

    SHA256

    8f15af94342e4aefccf2a304aa99a506844e2e3374242fcafda9a4bdd7885942

    SHA512

    35039e46fb926cb544b3db973439031c324a0c5827641ad83fa06139092fd4c84281462b8ace4508c8d730771a5c9d632b44d508cdff7de278ec754a9b641a11

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cb9a0d10491290870fcf63453f88efb4

    SHA1

    53ecceebd6d1df52fe7bf470260a4df5f03c5394

    SHA256

    ee193945dae52dade0dc1e12d5d93edf81122fac4670cf2fd9fdd7c824fc8b66

    SHA512

    16729e1208d204a1323213984da6cd604cbdd5d24a80332279be15810c9c0a95dbcdde26b39caa15b41bfc1f3668dec2c2670f64230bff49611bd77e41d615c6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    428bdb1189b51dca6f960f7339a75bcf

    SHA1

    bc2aa0f444a0f05127b15ab789396992b54198ba

    SHA256

    28d926cb364109f2ec285ded90129683f74740c0f38d277f1df52ab8e550db0b

    SHA512

    b1e73151e1a286deff359dd14c8d5beeb41a0969495e37fa5639598cce2a64da164a9543c34824a1f9e4dd3875603872f03caedae361a55878f283f64a36d9e6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BCOPU31\search[2].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Temp\CabC46F.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarC4A2.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\tmpB867.tmp

    Filesize

    28KB

    MD5

    a2851a33ba8515a054d85df6f4df68ad

    SHA1

    4ce32fbe884e173e1cf76aa8f954c7b249cf746a

    SHA256

    cdc6072607e1fe44ce318607d324a99dc2e3875536491778eb0653444d10be1c

    SHA512

    35cf7b895fec091355c60727ff13e49e0f01cad3ba2bcf0202596f06c37cd6c8b74bb771c9c11fbe1c2310f101e5b36c4b83d37190d38edb9ae1b4ad0f273df3

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    8d0213abc0e4285441d9593fc4f1b105

    SHA1

    0d03efc6daa9d5e1a508a1daf60fd02512b9d402

    SHA256

    5d503cf5edc7353c957254611ccfbc73f4510527e298ece806ede6b3b49c5c11

    SHA512

    39f7b32aad8b1f43fbc4cfc3afa8d25988ce1f7110c96081bc070b68d375192444bf38c090ec641e56069ec2ef2b761faa2b1d82a4de15af50f0f57f88a9fadf

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    d7b27cb074c11a29794c227bbfdb18ab

    SHA1

    28ae5075e3312bb0d400ee565cd190d302dcff7c

    SHA256

    0b5ef90388644893df1f2a0fe83521c5a9fce51fc1f74c40c4bc7cd6de216e22

    SHA512

    82dd626565dbf9be3ba49526e657caa0af2e7ddfd8c26d8647e8fc24a3c302be4cca3ec899977678596e1cdae5c6baa590ff6affb522707c286dfc9799910d8e

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2080-62-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-41-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-43-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-36-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-31-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-80-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-24-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-66-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-29-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-68-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-73-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-85-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2080-78-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2856-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2856-79-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2856-77-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2856-67-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2856-65-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2856-40-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2856-61-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2856-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2856-15-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2856-4-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB