Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/04/2024, 21:30

General

  • Target

    fdb0a875d2baadf2496ff00f77c3d28e_JaffaCakes118.exe

  • Size

    28KB

  • MD5

    fdb0a875d2baadf2496ff00f77c3d28e

  • SHA1

    611fcdac7ff2b6522a8ac3d8dd58760546681515

  • SHA256

    51d43b17f0c7e2401f4dfd92825ecad1102c7c35841162559958c9abecdf1322

  • SHA512

    4760ecf54fbd0dbcbe4135db2dccfe020f7a4820fce40dce6aeaea369f73b9866113f368e5ba05670600bc7a23bc8416f921239f391732994a27baab6fcdbe0d

  • SSDEEP

    384:D+t19SG6TCaUfN73OC3VZQ6l6FwbvTd07TU6MzdnnImYZC4tm6mWdxQ4v55bzMxH:Do9S0avwDTddhGAWk4R5HooY

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fdb0a875d2baadf2496ff00f77c3d28e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fdb0a875d2baadf2496ff00f77c3d28e_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    PID:1712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

  • memory/1712-0-0x0000000000760000-0x000000000076E000-memory.dmp

    Filesize

    56KB

  • memory/1712-1-0x0000000075160000-0x0000000075910000-memory.dmp

    Filesize

    7.7MB

  • memory/1712-2-0x0000000005020000-0x0000000005030000-memory.dmp

    Filesize

    64KB

  • memory/1712-3-0x0000000005860000-0x0000000005E04000-memory.dmp

    Filesize

    5.6MB

  • memory/1712-4-0x0000000005390000-0x0000000005422000-memory.dmp

    Filesize

    584KB

  • memory/1712-186-0x0000000007630000-0x000000000763A000-memory.dmp

    Filesize

    40KB

  • memory/1712-236-0x0000000005020000-0x0000000005030000-memory.dmp

    Filesize

    64KB

  • memory/1712-237-0x0000000075160000-0x0000000075910000-memory.dmp

    Filesize

    7.7MB

  • memory/1712-238-0x0000000005020000-0x0000000005030000-memory.dmp

    Filesize

    64KB

  • memory/1712-239-0x0000000005020000-0x0000000005030000-memory.dmp

    Filesize

    64KB