Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09/12/2024, 11:14

General

  • Target

    d95739cef11996b0af65b53e7629937c_JaffaCakes118.exe

  • Size

    28KB

  • MD5

    d95739cef11996b0af65b53e7629937c

  • SHA1

    3a28897302117de3282b0ed63bd0eb48a94bbc53

  • SHA256

    a5596043e1fa7482959e6cdca5a11f9fefb531ae2c81f283758c87547aeb5e60

  • SHA512

    44cc8cceb711200224c8097cfd5576397b1411350d493351da22375d2131ac2f0e21076696cc31c72fc1392f0b894a5627513e71ad427ab6c7e554f111cac47e

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN55N+kos:Dv8IRRdsxq1DjJcqf8p9

Malware Config

Signatures

  • Detects MyDoom family 10 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d95739cef11996b0af65b53e7629937c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d95739cef11996b0af65b53e7629937c_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fce4929c3013b49ade9e339cf21e3643

    SHA1

    a5ec4217ed53103716ea040e18778494dd95c969

    SHA256

    568b9f417977c09e36f134e8ce4fa7f7e8c9e2879c186e9134b3ab0b5b8d76a8

    SHA512

    aa52fafcfdf38fa78966c5b3258d68085a57ba98ddc40c36ab93800d7b656026b5affd3c7ad6e30e89110b6ca1879d1a194bd05ccaacd70915844a8e5ebd2cea

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    59413485a0a8b1d5f30a8122ba6592a3

    SHA1

    7485b935eea10d33ff25b604ce3e6c2a83883b7b

    SHA256

    0c676189df4d2cb456bb3f0d9b8571121a8f956989d3b17125daca9061944764

    SHA512

    53984f7af5ae860271e06e01aa12f4abeb9a9e21c487614ef3b336e96861f90468d52f616dbb2164dd9a8cedcb998c3784e1cfc19d110bc1858d5ba4f6e67298

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c39851a3e2c3cd823238ae4e76ae7b22

    SHA1

    7b3a09136062a73dc702974f922de585ce43ddea

    SHA256

    f243bc1ccf44c2332cbfdba0b76f494993cb0c1b0c0f313ba593eb1fcc6afd8b

    SHA512

    014abdbfd8908b33ca1bcf68e8135a79df1a2e4954d157c79070bf62dda029bd39ad1099e53e4350b3b95a09f949af4595f7457e251b971303fccb4ef344897b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cb6de3bcea472a038eb29c2081aeff53

    SHA1

    f3d22f86bea55ca03d9416185f7c154b76ef87c7

    SHA256

    b52d4f1bb71ec08d4943fd9ea3e4411edfb3b474087d55c0cc9591079760c394

    SHA512

    e5250275ed4e8446af89182db9378408cbc2957246ee01e34af0cbe6c816c47771761b41447b73b68b15d50adb23b2e50b19a3001050fbe1517ad426c21727d3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\default[1].htm

    Filesize

    315B

    MD5

    14b82aec966e8e370a28053db081f4e9

    SHA1

    a0f30ebbdb4c69947d3bd41fa63ec4929dddd649

    SHA256

    202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf

    SHA512

    ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\search[2].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Temp\Cab991B.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar99EA.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\tmp8DD0.tmp

    Filesize

    28KB

    MD5

    93730fc0f335769d1fd6de1774b17a17

    SHA1

    0f1e37dc3e054990f8cfcfbc4f904d8e077424f0

    SHA256

    aa0ebe724b3d5fcd8eb13eb04e204f790a8f20f7b1222cbadb96296df62965dd

    SHA512

    6b36d28f7d804cdb632b74afe090d61c6984242bd641767b9cb3bca4c229e5a1f9f736472d5a356964bc8fe20bbb3b5ab9619ca64e82ad3de71e2ab827933f18

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    d218d1d46c668e804333a3a7e5ea3fc8

    SHA1

    663903bb0f16d4341229108b0f77e8c84ca34ab4

    SHA256

    cb1b48deeab93f61bc22cad591d691fdf0d0aa6e104f301b4b6b311187323554

    SHA512

    d622797591bc7e31e988f59384da98fe36c7a610e9ff96ef208ccf029844e613cb44640b4f308befee90fb6a3bc0d62c8e540ada3ceb2b02d5b1497e9d4dd8c2

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    9ad2b1d84553c83a541c463f2f1cedc9

    SHA1

    9daa10912d8ebff05357733912865a21fa19c6cb

    SHA256

    0710b539d8faa593a01d03cc63e1f386a26a2f187f6a9ca97fcfb65aa0b55865

    SHA512

    c84a387cbac6fa147d6ca0ed0e75552d89c747e5a3e54e6a01e8a4a8b59143ef0fd59d07f4f455b1cc96b75f4479ea86b82ca283ab876c74256d49cbb790ce81

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2316-31-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2316-8-0x00000000001F0000-0x00000000001F8000-memory.dmp

    Filesize

    32KB

  • memory/2316-17-0x00000000001F0000-0x00000000001F8000-memory.dmp

    Filesize

    32KB

  • memory/2316-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2316-54-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2316-355-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2316-56-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2316-36-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2316-4-0x00000000001F0000-0x00000000001F8000-memory.dmp

    Filesize

    32KB

  • memory/2316-61-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2316-16-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2316-416-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2316-68-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2316-91-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3040-30-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-92-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-74-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-69-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-67-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-62-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-57-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-55-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-37-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-25-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-357-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-417-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB