Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/11/2024, 23:07

General

  • Target

    9e700d4ea0c2386dbc2cf25b0d5cd04c_JaffaCakes118.exe

  • Size

    28KB

  • MD5

    9e700d4ea0c2386dbc2cf25b0d5cd04c

  • SHA1

    ab16583265a7a93fe5f151e1af2f60eebc944943

  • SHA256

    fb7488d7d478bcef51e238958cbd38d56c241bc91832a005c78ee63f89b3c13c

  • SHA512

    9982a71c308dd414a44f412f50c6a0bae8c3830190e7cebbc8f303b5d95b6e65dd635fc433689f77e46f462f9b8839110272a4981dd157625bfafc7fd14ba958

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNy6o:Dv8IRRdsxq1DjJcqfP

Malware Config

Signatures

  • Detects MyDoom family 6 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e700d4ea0c2386dbc2cf25b0d5cd04c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9e700d4ea0c2386dbc2cf25b0d5cd04c_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\blTauEkyb.log

    Filesize

    1KB

    MD5

    57d6c13eea5e66e19d75bc292002df4b

    SHA1

    35863ad0ddbbc03a2f3ba2cbf1fe5f9f057299c8

    SHA256

    62d0c66c41b3bf12f3151152a23fc584eb645ea6f4ac18d704e521f3a8dc9c5a

    SHA512

    1c30f13bfa7ea76fa45d6860f994554ba9855cd7395dc26271324f056346dd58bcff01cc231ad3a66e588068e3356c9b89807179ef8198aea5cf19cf1e2c7517

  • C:\Users\Admin\AppData\Local\Temp\tmp2751.tmp

    Filesize

    28KB

    MD5

    695c5aa8da8749575ae609960291c3c4

    SHA1

    9c352a84bea032f8e64f30c98d07b8f05c3ed869

    SHA256

    3a4ae21af3e62b75dc09640946313042406f90718815769e633622b4fdfe6190

    SHA512

    3073690a30ec4556e6138a040f1b9d32303534bcf22f0a52417522838f01374021daba656b500410a90ce17b96e2e969e1e0af94ff7acb46c8dc06aa3049edba

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    b2f14cac57e893968b11b9037a35e9b7

    SHA1

    743c2fa9ad6661c9e99640061d201fc36cd271b3

    SHA256

    a13af357821010a3b1d349765b08a38227795d7a3a44901ba6bc393a7eefc6e8

    SHA512

    6aa5184ad3a96dcc3bc335537252ebd4ae4ffb4224b2b93a597b523e4dc19c9c625fff97e9530155b6fd70afd9e3291f442b56914cc8c5441ae3f28c08bb0121

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2180-17-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2180-2-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2180-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2180-87-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2180-85-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2180-4-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2180-92-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2180-61-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2180-9-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-43-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-62-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-38-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-50-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-55-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-57-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-33-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-45-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-31-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-86-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-88-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-93-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB