Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 13:57

General

  • Target

    3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe

  • Size

    460KB

  • MD5

    3a75ad36745a128836896eb0ac1bea80

  • SHA1

    0b9c0364ae194f2cc75e05c29d26eed6e7fd9223

  • SHA256

    02d33c5d52bc209fb12fcf89fed736ed55a9979fbd87b4e8c9df983f5b524455

  • SHA512

    60ba9e0ceffa9f07167b0df950bd6a594d5d506bb8d2badae2ad95b8c34a16cf17712a1e89563dd686a52e46d7a9df960cd78f1f847ba85d1fc036d4c60266f9

  • SSDEEP

    6144:Ab/2Sw+oJEdJGpT42yoW4RYMnlYnnzsEpPRvutJTtgWfOiMY3NewDyNYu:6kE/O4OW4SkYnnzlptuzhfOg3NRI

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\ppzltcqvggths.exe
      "C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\ppzltcqvggths.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\parent.txt

    Filesize

    460KB

    MD5

    3a75ad36745a128836896eb0ac1bea80

    SHA1

    0b9c0364ae194f2cc75e05c29d26eed6e7fd9223

    SHA256

    02d33c5d52bc209fb12fcf89fed736ed55a9979fbd87b4e8c9df983f5b524455

    SHA512

    60ba9e0ceffa9f07167b0df950bd6a594d5d506bb8d2badae2ad95b8c34a16cf17712a1e89563dd686a52e46d7a9df960cd78f1f847ba85d1fc036d4c60266f9

  • C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\ppzltcqvggths.exe

    Filesize

    7KB

    MD5

    e866084611bc2075e4f5e6f265144f20

    SHA1

    89e62a9c1ef200c5c35af37ec5169d6ee805a535

    SHA256

    a69c21088dd3cc1b86be21ff9784f9d87f083bd2317dc4c8b0b3982ee187250a

    SHA512

    c3ddbf564cfb30c977c59aa8f3e3f921e7d3cf1b934c35a22384f7eec45447cf37e25cbc12286fe26c5aed1cff856d65d08412cb5e2633c22b788fdeb9e57b86

  • memory/1480-8-0x000000001C4B0000-0x000000001C97E000-memory.dmp

    Filesize

    4.8MB

  • memory/1480-13-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

    Filesize

    9.6MB

  • memory/1480-7-0x000000001BFA0000-0x000000001BFE4000-memory.dmp

    Filesize

    272KB

  • memory/1480-9-0x000000001CA20000-0x000000001CABC000-memory.dmp

    Filesize

    624KB

  • memory/1480-10-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

    Filesize

    9.6MB

  • memory/1480-11-0x000000001BCD0000-0x000000001BCD8000-memory.dmp

    Filesize

    32KB

  • memory/1480-12-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

    Filesize

    9.6MB

  • memory/1480-6-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

    Filesize

    9.6MB

  • memory/1480-14-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

    Filesize

    9.6MB

  • memory/1480-15-0x000000001EC20000-0x000000001EC82000-memory.dmp

    Filesize

    392KB

  • memory/1480-5-0x00007FFADA365000-0x00007FFADA366000-memory.dmp

    Filesize

    4KB

  • memory/1480-18-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

    Filesize

    9.6MB

  • memory/1480-27-0x0000000022210000-0x00000000229B6000-memory.dmp

    Filesize

    7.6MB

  • memory/1480-28-0x00007FFADA0B0000-0x00007FFADAA51000-memory.dmp

    Filesize

    9.6MB

  • memory/1480-29-0x00007FFADA365000-0x00007FFADA366000-memory.dmp

    Filesize

    4KB