Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/04/2024, 23:22
Behavioral task
behavioral1
Sample
e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe
-
Size
47KB
-
MD5
e6196edd2050f5447e7389c158a3ab4f
-
SHA1
f430d6fb4373dbfba951329cdfc448f6e62f1ea4
-
SHA256
99efe177d328d788c6d1712517f49af30cf819c8d41b657390d8970d741fe5dd
-
SHA512
fe82d0ad88b4fd0e799acd26f9cb466019498a0a9a14cf2b5c104dcaea32cf0d8c7e5ead38311b2094614044efaf2313609c8c818705c15817caf1617745ae26
-
SSDEEP
768:Nqo0w3a8EnCYKKlOA0ACuoxb2Eu80Z400m51qDRQ6VjoF5/SP1233DAJ:NqGaNzpvChMEuPZxX4Ps5/8234
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4680 win32.exe -
Loads dropped DLL 1 IoCs
pid Process 4680 win32.exe -
resource yara_rule behavioral2/memory/2308-0-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral2/memory/2308-4-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral2/files/0x000a00000002312d-3.dat upx behavioral2/memory/4680-7-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral2/memory/4680-8-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral2/memory/4680-13-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral2/memory/4680-19-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral2/memory/4680-23-0x0000000000400000-0x000000000047D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wupd = "C:\\Windows\\system32\\win32.exe" e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\win32.exe e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\win32.exe win32.exe File created C:\Windows\SysWOW64\zlbw.dll win32.exe File created C:\Windows\SysWOW64\win32.exe e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2308 e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe Token: SeDebugPrivilege 4680 win32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2308 wrote to memory of 4680 2308 e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe 88 PID 2308 wrote to memory of 4680 2308 e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe 88 PID 2308 wrote to memory of 4680 2308 e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\win32.exewin32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5e6196edd2050f5447e7389c158a3ab4f
SHA1f430d6fb4373dbfba951329cdfc448f6e62f1ea4
SHA25699efe177d328d788c6d1712517f49af30cf819c8d41b657390d8970d741fe5dd
SHA512fe82d0ad88b4fd0e799acd26f9cb466019498a0a9a14cf2b5c104dcaea32cf0d8c7e5ead38311b2094614044efaf2313609c8c818705c15817caf1617745ae26
-
Filesize
45KB
MD5f42601d4ac18bb06d830b6f8e4500adf
SHA166ff00d72ed68fa417638b514610c7cf611ddb90
SHA2562c54ec6433444a5173a38c75f46c8bec63f90c3ed6efea20beac76c67bc27c95
SHA5128011e932f363fd5730a2cf27ca36a8b62e1c1e61d188bb08b6aad927e2b1a06f8b2ee1c26fff4863fa99d1675fc72d4159b331a3ae25acee0b18e3e41dcb741f