Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2024, 20:12

General

  • Target

    eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe

  • Size

    52KB

  • MD5

    eebc14dc671e8987bfbf8a7324d39c32

  • SHA1

    31aca267dd6fe314db15eeb0e64f6ce8eb3b7ec1

  • SHA256

    0b045e2dbcc371b3cda3ed893de3bb407aa42e063b86d71e3ef8f3a68ec804d1

  • SHA512

    ab71ae56a7b9219ef8a9ea03dd20d40a8ec369e385b2384dbcee3cd7518339ebcfbd8361c6583928957687e1fcb2bba76545ed4de00106ae1b03864f77913264

  • SSDEEP

    1536:N5VzcfA/6LrVpL74gfh16nHNq5DwhQBlr4suu0Fc/hd:/V2A/gVh74gpgt00h+0Fc/hd

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Users\Admin\AppData\Local\Temp\EINslazR05Bjmfr.exe
      C:\Users\Admin\AppData\Local\Temp\EINslazR05Bjmfr.exe
      2⤵
      • Executes dropped EXE
      PID:924
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    350KB

    MD5

    eece5309a24e944b239a85c2e5724bee

    SHA1

    e64ca55d6401abe5e36aa08e81b7c782e45c9e74

    SHA256

    7b0cb9f6eabc643f8ab4b0f6cfc60b8598683424a2e0780b9d6a933feea8f487

    SHA512

    36967d9300818fcc04b8c74e335bf782ee56d75cb6d7b1d11fef313a7d18157f14390322edb7ec921229fa465f4d12c14179ce4bd9a63b1298d13a961b559a5d

  • C:\Users\Admin\AppData\Local\Temp\EINslazR05Bjmfr.exe

    Filesize

    25KB

    MD5

    abbd49c180a2f8703f6306d6fa731fdc

    SHA1

    d63f4bfe7f74936b2fbace803e3da6103fbf6586

    SHA256

    5f411c0bd9ed9a42b0f07ed568c7d0cf358a83063b225a1f8f7da3296dde90f1

    SHA512

    290dd984acc451b778f3db8c510bae7aec1d9547c3ad0a1829df731c136e4ecc9a37dc6a786cf8f1ecc4d14339aed1288af25055f450f6f953138c8d4d5c36e9

  • C:\Windows\CTS.exe

    Filesize

    27KB

    MD5

    a6749b968461644db5cc0ecceffb224a

    SHA1

    2795aa37b8586986a34437081351cdd791749a90

    SHA256

    720023737d7ff700818f55612ba069a609a5ddea646bb3509b615ee3523a4ca2

    SHA512

    2a276816290746ed914af9cf6427aef31ce9395b8e9937090e329a8f74fb84c62d15b196e13346caa086842b3f5f549b9eb20cbf422d18c9c1b63e6342ea90b4

  • memory/924-16-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/4696-10-0x0000000000DC0000-0x0000000000DD8000-memory.dmp

    Filesize

    96KB

  • memory/4760-0-0x00000000005C0000-0x00000000005D8000-memory.dmp

    Filesize

    96KB

  • memory/4760-9-0x00000000005C0000-0x00000000005D8000-memory.dmp

    Filesize

    96KB