Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 08:40

General

  • Target

    f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe

  • Size

    84KB

  • MD5

    f9edce2c3e8e1fde251aa74ef501bae3

  • SHA1

    e379bf3fb40b59028359b27deeb985b05211d76b

  • SHA256

    15cbc1faf58ae12ad49c620d23a8e159d4940fb31e09b5c751e9599eff4e451a

  • SHA512

    48866ee2c95b7c9870ebe06bf695a8b2e9fa4b5fd308c9d647c3234017ad804cc488d13c183e1aeedc87f6bfd260ba850bac89bcfb1cac0cb261884187315ef1

  • SSDEEP

    1536:s9Z3KcR4mjD9r8226+d9Z3KcR4mjD9r8226+usKsG2PLnI:sr3KcWmjRrzSdr3KcWmjRrzSxJjnI

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    392KB

    MD5

    89f84c142d56760d81daa59a73b8388d

    SHA1

    9a563888a3421069830093419ce110b1f1a42065

    SHA256

    75662e7003b7ffa6be15924c7c767fcf4915cd1fe5eea0a9b62a37bfbd944f34

    SHA512

    9f089cff4e1229e7b8e4f404ed8e336cad4ef694e8d8935b53a153f1c0fb9d542b8926fbbfe4751a047271233a0c5a200849371ad985dbc863c296d7e606c521

  • C:\Users\Admin\AppData\Local\Temp\xLyGniYJbJBdPpf.exe

    Filesize

    84KB

    MD5

    decb364031e9b515933f0dea747b3681

    SHA1

    1a0cb6a47c7c8b367505b268c9758d00d15f52b3

    SHA256

    44bbec24e69ecff5e7c906af289449d4b0e2b5f425e02a87b1e5af63643c00da

    SHA512

    fb0749993bbf3d4385f7a07ab9bff82ae9375a9391cd41f27fbe3da9a417e33c2150c2810cab5b5ca80b600be3a79b645e796cf4e422db95f025aa955b959820

  • C:\Windows\CTS.exe

    Filesize

    71KB

    MD5

    57dc894376d6ffbf9af1929bd6688b6c

    SHA1

    cf5f1891e39142f13d3f007e2957a0d302efafff

    SHA256

    25001e3946468d3aa0f86f1ae322fb8354fc1c96052227346c41fb12d63fa129

    SHA512

    922c081df01cdcaef8cf91a484bdfe1c412a5e716aada86b3f3f61e020173cc9bd8318c072eff7f59140687fdaf3a722d62fc4c56891f906797a909da311dab1

  • memory/416-7-0x0000000000730000-0x0000000000747000-memory.dmp

    Filesize

    92KB

  • memory/416-32-0x0000000000730000-0x0000000000747000-memory.dmp

    Filesize

    92KB

  • memory/2728-0-0x00000000006C0000-0x00000000006D7000-memory.dmp

    Filesize

    92KB

  • memory/2728-9-0x00000000006C0000-0x00000000006D7000-memory.dmp

    Filesize

    92KB