Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2024, 13:26

General

  • Target

    10a295a5698997d5c88c590ffb5c8a4b_JaffaCakes118.exe

  • Size

    585KB

  • MD5

    10a295a5698997d5c88c590ffb5c8a4b

  • SHA1

    79ea9631a43ca8b44b0ec8b756925a7d3dc1912b

  • SHA256

    e53094f90013414237829f4c7ce84677b195ec13441a8f7e70272b25ec777f38

  • SHA512

    ea853e206f7ea5947362e8fe01914420698353c10479db78ca87d6f5ebeb5fa404a801d92b1ce5e9942a47a924465cffd5da3ceecc4518404a1cb8595b7cf795

  • SSDEEP

    12288:Wdx9uJFTuzAgmzJ1lg0zGs7mViaagEDeRRqEM9u8V8DIe:WdqyFq/x78zo79u8VAB

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10a295a5698997d5c88c590ffb5c8a4b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\10a295a5698997d5c88c590ffb5c8a4b_JaffaCakes118.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\d.jfm

    Filesize

    16KB

    MD5

    4d15f6094455f175fa0c03ae11f780ef

    SHA1

    81894539e0e355a1358578ebfb7b010ead968065

    SHA256

    8ade615838341daf4425410d49c4c6d4ef05605815be828ac1c2f39aa96b62db

    SHA512

    03c607e47378c28394f6cadba52d0a28791c68de6efcbaf2d76fb4dd9f58b5afdadb37107220940daae96dcd4b9aad8efc8be947a9c414a8b032cd8eb66d0ceb

  • C:\Users\Admin\AppData\Local\Temp\d.jfm

    Filesize

    16KB

    MD5

    73c22b5ec146b9b71336116104b3c785

    SHA1

    b4461199d26dcded59a3fa8f7599adf51f3280fe

    SHA256

    bad5301c29339a9cca55b58b58d641b164f0a0df1839b73eb9901af954a78acd

    SHA512

    8f4e7b638e57ff470e9305ad10268f4bfa580300faf3d35d822d10cb209d4989377eebe67cfb55119219343a2f64e9d4f4cfcd77c90c4231e86c3552a57c04e1

  • C:\Users\Admin\AppData\Local\Temp\d.jfm

    Filesize

    16KB

    MD5

    261b706c9664f711918dff9ece1063d2

    SHA1

    1aa9c6a3a31e197799f6f51d4e169dbe073510f3

    SHA256

    79433076469c1ac54d1060ee8bc5035cb15e2221f24489779e05b7ee0e9db7a5

    SHA512

    15dab22888aaa89d03c4c6378b2c63aa76910bd7defff0c79a0ee9c38432379d1546a1aa557903f4e1179ce43e5a1d27b9b1fc9ac7278b30095d5ae39d2f19d6

  • memory/3480-4-0x00000000731CE000-0x00000000731CF000-memory.dmp

    Filesize

    4KB

  • memory/3480-5-0x0000000002940000-0x000000000294C000-memory.dmp

    Filesize

    48KB

  • memory/3480-6-0x00000000731C0000-0x0000000073970000-memory.dmp

    Filesize

    7.7MB

  • memory/3480-7-0x00000000731C0000-0x0000000073970000-memory.dmp

    Filesize

    7.7MB

  • memory/3480-8-0x00000000731C0000-0x0000000073970000-memory.dmp

    Filesize

    7.7MB

  • memory/3480-9-0x0000000002720000-0x00000000027F0000-memory.dmp

    Filesize

    832KB

  • memory/3480-0-0x0000000000400000-0x0000000000523000-memory.dmp

    Filesize

    1.1MB

  • memory/3480-3-0x0000000002720000-0x00000000027F0000-memory.dmp

    Filesize

    832KB

  • memory/3480-2-0x0000000002720000-0x00000000027F0000-memory.dmp

    Filesize

    832KB

  • memory/3480-343-0x0000000000400000-0x0000000000523000-memory.dmp

    Filesize

    1.1MB

  • memory/3480-344-0x0000000002720000-0x00000000027F0000-memory.dmp

    Filesize

    832KB

  • memory/3480-346-0x00000000731C0000-0x0000000073970000-memory.dmp

    Filesize

    7.7MB