Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 18:15

General

  • Target

    e58e1a94f496400a4dedbefcaf340b2b_JaffaCakes118.exe

  • Size

    468KB

  • MD5

    e58e1a94f496400a4dedbefcaf340b2b

  • SHA1

    ecea838bb847137c29705c0b546704ff486a4f46

  • SHA256

    5471a63ff1fcd035164628b783495591d3836c3153f2e1730929ed18b550f5d7

  • SHA512

    b7b60fabd12f902f8cd2f481994f23c4fb61fec28700ccf98bb376345b184a1fecb52334fe1e64b3873580409f57065f6c51b989f31803fe38745b130904b7b6

  • SSDEEP

    12288:A06ld0/XOW0WVb3uPjl5XthpFN2BNp/OqAo1/S:A0U0P4yDyf9PT2BN0qAS/S

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 50 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e58e1a94f496400a4dedbefcaf340b2b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e58e1a94f496400a4dedbefcaf340b2b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3944
    • C:\Users\Admin\AppData\Local\Temp\e58e1a94f496400a4dedbefcaf340b2b_JaffaCakes118.exe
      e58e1a94f496400a4dedbefcaf340b2b_JaffaCakes118.exe
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3008
      • C:\Users\Admin\xuXKCQEP.exe
        C:\Users\Admin\xuXKCQEP.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3996
      • C:\Users\Admin\toast.exe
        C:\Users\Admin\toast.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Users\Admin\toast.exe
          toast.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1184
      • C:\Users\Admin\voast.exe
        C:\Users\Admin\voast.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3972
        • C:\Users\Admin\voast.exe
          voast.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4824
          • C:\Windows\explorer.exe
            000000B0*
            5⤵
              PID:3212
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 236
              5⤵
              • Program crash
              PID:4780
        • C:\Users\Admin\woast.exe
          C:\Users\Admin\woast.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1564
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4824 -ip 4824
      1⤵
        PID:3964

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\toast.exe

        Filesize

        152KB

        MD5

        b6d3a09df822fcf55b889b57c5ad799e

        SHA1

        dc44a91e89534819dcb18d18a42e2c0d3d3b649f

        SHA256

        83f8d74aa948dc8569f2f44174eb4da6e3bf0d6ef9293c8a92d882c2fda0e07c

        SHA512

        a7330d31a38361f41ae8385ff0541455fd098e874a29b0e8de3c92800fbe4ad2aa8a7a0374482d0e8a8db3363ca2e86c60216b9406eb306fe061bfde8086ebf1

      • C:\Users\Admin\voast.exe

        Filesize

        242KB

        MD5

        dc6332b873df679e69e099579c8bc22d

        SHA1

        0341ad78eff722fae4142aa1da9e4be0116569f9

        SHA256

        8c95e0048da1c72815701a5bb8000023b96433ad05e63e568ee28246c153ab04

        SHA512

        a6d9966765ede960b5f3929a61337d5582e40fae12cf5176dad9ec1ab608f4d73481ab1cc0ba168e162039fd3aabd75ceb16966b38999d9f71af2a5354fb7376

      • C:\Users\Admin\woast.exe

        Filesize

        24KB

        MD5

        f29656c436f7a25b63fe325b01a86a95

        SHA1

        148fe98b4901aaf454118c89ec71f4d36bed05bc

        SHA256

        1cc6a49d67f8f63801d0ffa3722f96405995e9f30958e5a368589591583932de

        SHA512

        d4eae9c9e02a1887ca30cd1750e73ade9d071594017e6d0d1cead2eff9c418b327752525fac130356d2454325e58ae54e24dd246784f15481ba2c01db7d097e7

      • C:\Users\Admin\xuXKCQEP.exe

        Filesize

        156KB

        MD5

        35362b609d4c80aa54977dd3c34f71a1

        SHA1

        0f561d1d9aa9543d1e9f759b90f6ff6f8b18dd89

        SHA256

        5c3e9c19f2015acdfda9921a68d6822348d4f82b6b1d12d248264d1361d72ca9

        SHA512

        e96bc0bb4cea72ad7fa55af13a48e4d16c43b66238e663247db93a977d7f926241cae8a3672334cbe10ada0934401472e483d4067ace1358409068984949e9cb

      • memory/1184-31-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/1184-25-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/1184-30-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/1184-21-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/1184-22-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/1184-23-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/1184-24-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/2840-29-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/3008-5-0x0000000000400000-0x0000000000495000-memory.dmp

        Filesize

        596KB

      • memory/3008-36-0x0000000000400000-0x0000000000495000-memory.dmp

        Filesize

        596KB

      • memory/3008-8-0x0000000000400000-0x0000000000495000-memory.dmp

        Filesize

        596KB

      • memory/3008-72-0x0000000000400000-0x0000000000495000-memory.dmp

        Filesize

        596KB

      • memory/3008-3-0x0000000000400000-0x0000000000495000-memory.dmp

        Filesize

        596KB

      • memory/3212-53-0x0000000000970000-0x0000000000985000-memory.dmp

        Filesize

        84KB

      • memory/3944-7-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/3944-0-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/3972-41-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/3972-50-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/4824-45-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/4824-46-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/4824-51-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/4824-44-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/4824-54-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/4824-43-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/4824-42-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB