Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 06:31

General

  • Target

    f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.exe

  • Size

    417KB

  • MD5

    f32a10b6563c44f044d0f23d973c438b

  • SHA1

    694c07a21391b923f145de6cddc5365583361bc7

  • SHA256

    23663eb4b97744b7b9402a7aed8276a637bd7e6a39beb0abf29121b7d2e8b205

  • SHA512

    b282ee343d0e898f23d4a38a550d100a807950d0d1b66eb4dfda2ce175313a6b7bb1187fabfe846b615dfa14f923990839f06dd7efe165505de44eff1aa12679

  • SSDEEP

    6144:2/QiQP7CL6lhU7dXYwQfEyZFpD4G0dkxXyVlcG40eAw38o85XOC8T/FUyKGpM9Ck:OQiG7Cn7dXYwEZZFp8njlcGpX98iR4o

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Users\Admin\AppData\Local\Temp\is-D4AS7.tmp\f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-D4AS7.tmp\f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.tmp" /SL5="$401CA,139007,56832,C:\Users\Admin\AppData\Local\Temp\f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-8T737.tmp\ex.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1824
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4qpd05tf.0z1.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\is-8T737.tmp\av.txt

    Filesize

    1B

    MD5

    68b329da9893e34099c7d8ad5cb9c940

    SHA1

    adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

    SHA256

    01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

    SHA512

    be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

  • C:\Users\Admin\AppData\Local\Temp\is-8T737.tmp\ex.bat

    Filesize

    786B

    MD5

    c053a6c8edc15d58a6f27cbf9741ed55

    SHA1

    f5f4f9e828cb6ec73c8d037875a00c1ff2b69439

    SHA256

    7f84c9e6354c877092564afa5a09c978a61fc60aebe268c43923af8d421eb8d6

    SHA512

    09366abe48e54d3f4ca0d3fa29c99570db6de111e89bfc6edcb5d341b1126f2a00f31222d374295b915ec321854ba8e821bb169344f5cd8871a59f41fbe9596b

  • C:\Users\Admin\AppData\Local\Temp\is-8T737.tmp\itdownload.dll

    Filesize

    201KB

    MD5

    fda896f0acbb98fa2fd8763f7e0a7b7d

    SHA1

    87520c200aa1ee03fa627073053b9887147b2975

    SHA256

    2182268006a950cb31f425e4ce8aa31c9b4d5f7f84dd09e8a854710ddde31b0e

    SHA512

    2dfc45451a3128ff87910c1cfca91556e69f4cf367b9072e32e0af1676eba1a8c473e061e78971e910ca6d6889ad9b1aca2a4c56186e7003d200fe5f57f39550

  • C:\Users\Admin\AppData\Local\Temp\is-D4AS7.tmp\f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.tmp

    Filesize

    694KB

    MD5

    86462bc76b244bac73ee6ffe47354be2

    SHA1

    c66462dc233887f86f9e05ee36086de4edfd99b6

    SHA256

    e3da91f01ffb504352b5e8237a5465d0f492a750a7c9a6cef22b3a5d08230fc9

    SHA512

    c0cbe3a39c2fd18e257500faacafd9fc8913221278e492b355acf64e6d97ff622a46a325a5c18cee5843a1660fda64dbc3172fac642de77ed12321085d67cb65

  • memory/2068-6-0x0000000002240000-0x0000000002241000-memory.dmp

    Filesize

    4KB

  • memory/2068-15-0x0000000003A40000-0x0000000003A7C000-memory.dmp

    Filesize

    240KB

  • memory/2068-53-0x0000000002240000-0x0000000002241000-memory.dmp

    Filesize

    4KB

  • memory/2068-52-0x0000000003A40000-0x0000000003A7C000-memory.dmp

    Filesize

    240KB

  • memory/2068-51-0x0000000000400000-0x00000000004BD000-memory.dmp

    Filesize

    756KB

  • memory/3440-50-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3440-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4040-27-0x0000000005030000-0x0000000005096000-memory.dmp

    Filesize

    408KB

  • memory/4040-43-0x00000000074C0000-0x0000000007A64000-memory.dmp

    Filesize

    5.6MB

  • memory/4040-25-0x0000000004DF0000-0x0000000004E12000-memory.dmp

    Filesize

    136KB

  • memory/4040-37-0x00000000058D0000-0x0000000005C24000-memory.dmp

    Filesize

    3.3MB

  • memory/4040-38-0x0000000005DA0000-0x0000000005DBE000-memory.dmp

    Filesize

    120KB

  • memory/4040-39-0x0000000005DD0000-0x0000000005E1C000-memory.dmp

    Filesize

    304KB

  • memory/4040-40-0x0000000006E70000-0x0000000006F06000-memory.dmp

    Filesize

    600KB

  • memory/4040-41-0x00000000062F0000-0x000000000630A000-memory.dmp

    Filesize

    104KB

  • memory/4040-42-0x0000000006310000-0x0000000006332000-memory.dmp

    Filesize

    136KB

  • memory/4040-26-0x0000000004E90000-0x0000000004EF6000-memory.dmp

    Filesize

    408KB

  • memory/4040-44-0x00000000080F0000-0x000000000876A000-memory.dmp

    Filesize

    6.5MB

  • memory/4040-47-0x0000000073610000-0x0000000073DC0000-memory.dmp

    Filesize

    7.7MB

  • memory/4040-24-0x00000000050A0000-0x00000000056C8000-memory.dmp

    Filesize

    6.2MB

  • memory/4040-23-0x0000000004A60000-0x0000000004A70000-memory.dmp

    Filesize

    64KB

  • memory/4040-20-0x00000000027D0000-0x0000000002806000-memory.dmp

    Filesize

    216KB

  • memory/4040-22-0x0000000004A60000-0x0000000004A70000-memory.dmp

    Filesize

    64KB

  • memory/4040-21-0x0000000073610000-0x0000000073DC0000-memory.dmp

    Filesize

    7.7MB