Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2025, 15:53

General

  • Target

    JaffaCakes118_8a2bdb5e601deb704b795bc5eebf45da.exe

  • Size

    1.2MB

  • MD5

    8a2bdb5e601deb704b795bc5eebf45da

  • SHA1

    0c75f944e504dd81065c3c0ada2c025211dd5aa0

  • SHA256

    e7f547a1c4b5a322747bcbfcef945029971c0228c1bbf0cf43daf995c7da8b51

  • SHA512

    a3d30dc192ba36097914af922beb90f87519e528c2e655cab20d715e50bd958ea81121e65d4efa110f2876444a5955a8adb0e313faff74b22e9594fc4f38066a

  • SSDEEP

    24576:onzBtBeOxAQmXWRFJSjfUEBgddrL4/S5po1U3DBl2rs+rrv1xKAsRKsu:o9tB/rmmUsZVL4q3Bl2rs+fKo

Malware Config

Signatures

  • Detected google phishing page 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 15 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a2bdb5e601deb704b795bc5eebf45da.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a2bdb5e601deb704b795bc5eebf45da.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Users\Admin\AppData\Local\Temp\temp.exe
      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Windows\uninstal.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2188
  • C:\Windows\system.exe
    C:\Windows\system.exe
    1⤵
    • Detected google phishing page
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\uninstal.bat

    Filesize

    134B

    MD5

    d844dfb0f997e4d32cdb6dafa4d7717a

    SHA1

    eaa7b33e52129f946e1aca0ce3cf45a7ce36b5ec

    SHA256

    0f38f96239893411209b61471bb7c2412a8637ce0e5cbf9cc3c23e14ee44759a

    SHA512

    fdeeeda586bf1d748ab962bd579ab3ef69a59ab9306bd3b29663dd496bba31e0a20b62e6076c08bfef44ad821e9dd69e88a29a56d427cbba532947cf91947be5

  • \Users\Admin\AppData\Local\Temp\temp.exe

    Filesize

    799KB

    MD5

    2cb734d6e80d55630dbefbdb58a9cfe2

    SHA1

    6f66e6ba349448a107720312f8a21043389034d3

    SHA256

    959ed1fcdf9476c97a155f5f2cc349b9fc2aa19e7e9d5c6dc2974d8a895cc030

    SHA512

    8a5dacb4c1c042e029c7ad2d8e05fced89c17bcc0d0a6952417272927ddd9ecfe4147b11798dce0b8bfc52aa5d55d7bee598fa510b262cb13896dba88271d1b1

  • memory/1016-14-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/1016-16-0x0000000000490000-0x0000000000491000-memory.dmp

    Filesize

    4KB

  • memory/1016-30-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/1016-29-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/1016-28-0x0000000003110000-0x0000000003114000-memory.dmp

    Filesize

    16KB

  • memory/1016-27-0x0000000001E20000-0x0000000001E21000-memory.dmp

    Filesize

    4KB

  • memory/1016-26-0x0000000001E30000-0x0000000001E31000-memory.dmp

    Filesize

    4KB

  • memory/1016-25-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

    Filesize

    4KB

  • memory/1016-24-0x0000000001DD0000-0x0000000001DD1000-memory.dmp

    Filesize

    4KB

  • memory/1016-23-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

    Filesize

    4KB

  • memory/1016-22-0x0000000001E10000-0x0000000001E11000-memory.dmp

    Filesize

    4KB

  • memory/1016-21-0x0000000000500000-0x0000000000501000-memory.dmp

    Filesize

    4KB

  • memory/1016-20-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

    Filesize

    4KB

  • memory/1016-19-0x0000000000540000-0x0000000000541000-memory.dmp

    Filesize

    4KB

  • memory/1016-18-0x0000000000550000-0x0000000000551000-memory.dmp

    Filesize

    4KB

  • memory/1016-17-0x0000000000480000-0x0000000000481000-memory.dmp

    Filesize

    4KB

  • memory/1016-13-0x0000000000530000-0x0000000000531000-memory.dmp

    Filesize

    4KB

  • memory/1016-15-0x0000000001D90000-0x0000000001D91000-memory.dmp

    Filesize

    4KB

  • memory/1016-2-0x0000000000410000-0x0000000000411000-memory.dmp

    Filesize

    4KB

  • memory/1016-1-0x00000000004A0000-0x00000000004F4000-memory.dmp

    Filesize

    336KB

  • memory/1016-8-0x0000000000420000-0x0000000000421000-memory.dmp

    Filesize

    4KB

  • memory/1016-11-0x0000000000460000-0x0000000000461000-memory.dmp

    Filesize

    4KB

  • memory/1016-9-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/1016-12-0x0000000003120000-0x0000000003122000-memory.dmp

    Filesize

    8KB

  • memory/1016-7-0x0000000000440000-0x0000000000441000-memory.dmp

    Filesize

    4KB

  • memory/1016-6-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/1016-5-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/1016-4-0x0000000000450000-0x0000000000451000-memory.dmp

    Filesize

    4KB

  • memory/1016-3-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/1016-10-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/1016-41-0x0000000010000000-0x00000000100C1000-memory.dmp

    Filesize

    772KB

  • memory/1016-40-0x00000000004A0000-0x00000000004F4000-memory.dmp

    Filesize

    336KB

  • memory/1016-0-0x0000000010000000-0x00000000100C1000-memory.dmp

    Filesize

    772KB

  • memory/2120-76-0x0000000000400000-0x00000000004D206F-memory.dmp

    Filesize

    840KB

  • memory/2120-80-0x0000000000400000-0x00000000004D206F-memory.dmp

    Filesize

    840KB

  • memory/2120-81-0x0000000000400000-0x00000000004D206F-memory.dmp

    Filesize

    840KB

  • memory/2120-85-0x0000000000400000-0x00000000004D206F-memory.dmp

    Filesize

    840KB

  • memory/2120-89-0x0000000000400000-0x00000000004D206F-memory.dmp

    Filesize

    840KB

  • memory/2404-55-0x0000000000400000-0x00000000004D206F-memory.dmp

    Filesize

    840KB