Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    194s
  • max time network
    206s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 11:06

General

  • Target

    fa2a0b08fbec8f1157c2b79fcbdea9bd_JaffaCakes118.exe

  • Size

    282KB

  • MD5

    fa2a0b08fbec8f1157c2b79fcbdea9bd

  • SHA1

    8338405f6340baa49df56079b201add4c7e31562

  • SHA256

    e162eb9d96b5c0ba6ff5e17183bea1c1763c8d7f78f04ddea226e58a0af905d5

  • SHA512

    4782e957065508f63069cd2b7d1adf364de3a65c0fa138b413397d219e9cec057bbebaea09c374275d9e429af62f98e4380fef13e18de9888114df438fb286be

  • SSDEEP

    6144:Dfo+wqc2b1tBApXLTJAq4nAnCJZQuJWB/RvJLoCJcvH+k0qCNCJcvRwqc2tvOdSb:Db+RTbHWooAKCDTTgIQH

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa2a0b08fbec8f1157c2b79fcbdea9bd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa2a0b08fbec8f1157c2b79fcbdea9bd_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:4940
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x33c 0x308
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2524
  • C:\Windows\system32\werfault.exe
    werfault.exe /hc /shared Global\81214bcba6704acc9cb05c2ea948a77b /t 5100 /p 1952 2524
    1⤵
      PID:2388

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\BASSMOD.dll

      Filesize

      33KB

      MD5

      e4ec57e8508c5c4040383ebe6d367928

      SHA1

      b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

      SHA256

      8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

      SHA512

      77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

    • memory/4940-0-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

    • memory/4940-4-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/4940-6-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/4940-15-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/4940-16-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/4940-17-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/4940-18-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/4940-19-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/4940-20-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB