Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2025, 10:27

General

  • Target

    JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe

  • Size

    80KB

  • MD5

    5da3837530dd6b1a9666ea002aef5238

  • SHA1

    41893ba57e61f8b177775c4d8ff982a8ec73e94e

  • SHA256

    81e6145cbc93443083f2398466f3a7d39c52dcac816b92b4619576ce531c0624

  • SHA512

    666fd1978741d8b4d6360bf46d93e957af5931f1777021e75ed403a125d5d9d0123410b41c88329d4595c587b125a2e85e09ec5e0f5498651d690ff344f64cd4

  • SSDEEP

    1536:9HFo6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtLg39/CF1b:9HFo8dSE2EwR4uY41HyvYLg39/Cz

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bjxvuivt.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES38BD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc38BC.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2664
    • C:\Users\Admin\AppData\Local\Temp\tmp37A4.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp37A4.tmp.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES38BD.tmp

    Filesize

    1KB

    MD5

    688f8ca63a4366d61fd9d22f63ab0c5a

    SHA1

    cf6218f7700c973faf31b993b0d228c12703081d

    SHA256

    671bce54fb69abef3092bb0191d1bbd37485a5a98406ecc7d49803a77b4b7afa

    SHA512

    19e9fd873367fe902cba501bd79105d082f9b076de83872a4d3da16fa948e1edc506dc2bc0f6507e343c97e97814f630bef72641bc8bed18a98236871e9f440e

  • C:\Users\Admin\AppData\Local\Temp\bjxvuivt.0.vb

    Filesize

    15KB

    MD5

    940d157842759692a6484444fa267f81

    SHA1

    71ae48d417e06c3597d3c7b0db33ef4850377b90

    SHA256

    8666e39ef64250cc97f9a7519a8095267a841e1a8498a293501ebfbc886595ca

    SHA512

    1c18b5efe5d87465c53f23e266c5f9e5b1794c4b2985163649d37cf8eb74089924f2f4d058dfa8f21be70870c590761c912713d7efdb53e57cdd01e329ac2e80

  • C:\Users\Admin\AppData\Local\Temp\bjxvuivt.cmdline

    Filesize

    266B

    MD5

    88511e980322352dafcaccc7e8e603ca

    SHA1

    06613e76a0b99f03d246cb6d2bdca0f07c526b84

    SHA256

    ebdeb2f568ca90724ef6491a39a1b2eb1d917a8a62aa0e0c81522d6f99fea124

    SHA512

    e5d5f4d62f462fcbf57544ec32fb67f0fa45074a5fcc65555e3df1d2b169db0acdf62613ce2169ef6ba68b34dccabe608b316e8b6f9f5d26f271096ae27fe506

  • C:\Users\Admin\AppData\Local\Temp\tmp37A4.tmp.exe

    Filesize

    78KB

    MD5

    396f360a9345d1360d34c0ca39d3fd24

    SHA1

    6e333e92e9fae9fbc98ec7f4c923e5f6731f4a8f

    SHA256

    e583078ae31b379e7f01276b4f3abbca722c9346c14180401d12b71aef4a9ce6

    SHA512

    337e1419b01e78bf8d0851494e8e7f0ca546c2027bbeb2bbad1de50090d80253c344562a9b431a445b7a19de992f2a4c05c35bb23ae9b6d88f0383101dd0ee6d

  • C:\Users\Admin\AppData\Local\Temp\vbc38BC.tmp

    Filesize

    660B

    MD5

    7e41bf3215bc8a6d5c8bba70735e42fe

    SHA1

    2a74cd4a3cbc0ae8084a4939553cc69ee8a86997

    SHA256

    1b6e40e3b18580fab7f4be3c5d5a06560d373c4671e489bd2bf1313567761154

    SHA512

    f7941273990f07659723fb4a70b49902bc6245b9eb2769599ae5b49b1f1cdafb4a7f788f26a87288d3cc3675a03501d41b89aae2b1942357ba3c022d9f0701b5

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    6870a276e0bed6dd5394d178156ebad0

    SHA1

    9b6005e5771bb4afb93a8862b54fe77dc4d203ee

    SHA256

    69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4

    SHA512

    3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809

  • memory/2780-8-0x0000000073FA0000-0x000000007454B000-memory.dmp

    Filesize

    5.7MB

  • memory/2780-18-0x0000000073FA0000-0x000000007454B000-memory.dmp

    Filesize

    5.7MB

  • memory/3044-0-0x0000000073FA1000-0x0000000073FA2000-memory.dmp

    Filesize

    4KB

  • memory/3044-2-0x0000000073FA0000-0x000000007454B000-memory.dmp

    Filesize

    5.7MB

  • memory/3044-1-0x0000000073FA0000-0x000000007454B000-memory.dmp

    Filesize

    5.7MB

  • memory/3044-24-0x0000000073FA0000-0x000000007454B000-memory.dmp

    Filesize

    5.7MB