Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    87s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 11:16

General

  • Target

    e26aba2d7b3bd91986727f591743b8cd_JaffaCakes118.exe

  • Size

    1012KB

  • MD5

    e26aba2d7b3bd91986727f591743b8cd

  • SHA1

    68658f119e0633f61996980c6dfc9c7462fe6c9f

  • SHA256

    dfa6d5a5a32535f4fbcc85817bdc1799340f5d1c410da1bcd5e36f244f8b0eb0

  • SHA512

    0b46ba456cd4d4773622d29a3841c8473d3f428cf0870039b7bc255550d6cd2260214d8373138861ea2b16925675ca2d4b15bf00cab6a9ce399b2810f3e6402b

  • SSDEEP

    24576:dFPUd2jiidMjLygLX4A8hwcjKO+T1B+5vMiqt0gj2eR:TPUEjii4LygL47hwcabqO7

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e26aba2d7b3bd91986727f591743b8cd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e26aba2d7b3bd91986727f591743b8cd_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Users\Admin\AppData\Local\Temp\e26aba2d7b3bd91986727f591743b8cd_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\e26aba2d7b3bd91986727f591743b8cd_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\e26aba2d7b3bd91986727f591743b8cd_JaffaCakes118.exe" /TN Google_Trk_Updater /F
        3⤵
        • Creates scheduled task(s)
        PID:740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\e26aba2d7b3bd91986727f591743b8cd_JaffaCakes118.exe

    Filesize

    1012KB

    MD5

    77cc8b54f6e84aa95c645b2343064730

    SHA1

    6afc4be28730b2c61d664d67484a41a2386fe878

    SHA256

    09336ffaa06ea7f33598f8b4f67a3d52abcd23456c353993b31b2b4adaf869fb

    SHA512

    503414a63f5dc16104b76ddd08b82ea12749878c3b9a8dd8eea5d98980bdde4e348eb46cccc9c8fa0a7586c5ef235880c82e87c5f3adad6564646b5fba3500d6

  • memory/1276-16-0x0000000001510000-0x0000000001593000-memory.dmp

    Filesize

    524KB

  • memory/1276-14-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/1276-20-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1276-22-0x0000000004FC0000-0x000000000503E000-memory.dmp

    Filesize

    504KB

  • memory/1276-27-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1968-0-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/1968-1-0x0000000000150000-0x00000000001D3000-memory.dmp

    Filesize

    524KB

  • memory/1968-2-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

  • memory/1968-12-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB