Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 23:22

General

  • Target

    e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe

  • Size

    47KB

  • MD5

    e6196edd2050f5447e7389c158a3ab4f

  • SHA1

    f430d6fb4373dbfba951329cdfc448f6e62f1ea4

  • SHA256

    99efe177d328d788c6d1712517f49af30cf819c8d41b657390d8970d741fe5dd

  • SHA512

    fe82d0ad88b4fd0e799acd26f9cb466019498a0a9a14cf2b5c104dcaea32cf0d8c7e5ead38311b2094614044efaf2313609c8c818705c15817caf1617745ae26

  • SSDEEP

    768:Nqo0w3a8EnCYKKlOA0ACuoxb2Eu80Z400m51qDRQ6VjoF5/SP1233DAJ:NqGaNzpvChMEuPZxX4Ps5/8234

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e6196edd2050f5447e7389c158a3ab4f_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Windows\SysWOW64\win32.exe
      win32.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\win32.exe

    Filesize

    47KB

    MD5

    e6196edd2050f5447e7389c158a3ab4f

    SHA1

    f430d6fb4373dbfba951329cdfc448f6e62f1ea4

    SHA256

    99efe177d328d788c6d1712517f49af30cf819c8d41b657390d8970d741fe5dd

    SHA512

    fe82d0ad88b4fd0e799acd26f9cb466019498a0a9a14cf2b5c104dcaea32cf0d8c7e5ead38311b2094614044efaf2313609c8c818705c15817caf1617745ae26

  • C:\Windows\SysWOW64\zlbw.dll

    Filesize

    45KB

    MD5

    f42601d4ac18bb06d830b6f8e4500adf

    SHA1

    66ff00d72ed68fa417638b514610c7cf611ddb90

    SHA256

    2c54ec6433444a5173a38c75f46c8bec63f90c3ed6efea20beac76c67bc27c95

    SHA512

    8011e932f363fd5730a2cf27ca36a8b62e1c1e61d188bb08b6aad927e2b1a06f8b2ee1c26fff4863fa99d1675fc72d4159b331a3ae25acee0b18e3e41dcb741f

  • memory/2308-0-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/2308-4-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/4680-7-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/4680-8-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/4680-13-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/4680-19-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/4680-23-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB