Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2024, 03:41

General

  • Target

    4e46a05d653ff89feac1faa4d55945eb_JaffaCakes118.exe

  • Size

    33KB

  • MD5

    4e46a05d653ff89feac1faa4d55945eb

  • SHA1

    a570e9a39a9ff9d70a0a30e0a057ff94860fd356

  • SHA256

    67d2adb1141f5b68c8f11d7dd7456d8628d2073a228902a71232e8f1b8d6871f

  • SHA512

    85206155f564dc036206ea8dae01a65a7dcad6bc3177a556227bf24de9096b656102771deb639dce86a490a6669d4394ab2576d4fecbbf00910967c5cf8cce9c

  • SSDEEP

    768:NyMHExfpdfohQEI/ctS09eqIXr1iEpTH0:0kgfroez/c0keqohiqH

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 6 IoCs
  • Enumerates processes with tasklist 1 TTPs 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4e46a05d653ff89feac1faa4d55945eb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4e46a05d653ff89feac1faa4d55945eb_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3936
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Luna__GTA_Launcher_Rockstar_Edition.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5036
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "IMAGENAME eq GTA5.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1388
      • C:\Windows\SysWOW64\findstr.exe
        findstr "GTA5.exe"
        3⤵
          PID:3028
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /FI "IMAGENAME eq launcher.exe"
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3676
        • C:\Windows\SysWOW64\findstr.exe
          findstr "launcher.exe"
          3⤵
            PID:2540
          • C:\Windows\SysWOW64\timeout.exe
            timeout 20
            3⤵
            • Delays execution with timeout.exe
            PID:1352
          • C:\Windows\SysWOW64\timeout.exe
            timeout 15
            3⤵
            • Delays execution with timeout.exe
            PID:32
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq GTA5.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4392
          • C:\Windows\SysWOW64\findstr.exe
            findstr "GTA5.exe"
            3⤵
              PID:4428
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist /FI "IMAGENAME eq launcher.exe"
              3⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:4580
            • C:\Windows\SysWOW64\findstr.exe
              findstr "launcher.exe"
              3⤵
                PID:4804
              • C:\Windows\SysWOW64\timeout.exe
                timeout 20
                3⤵
                • Delays execution with timeout.exe
                PID:3188
              • C:\Windows\SysWOW64\timeout.exe
                timeout 15
                3⤵
                • Delays execution with timeout.exe
                PID:4244
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist /FI "IMAGENAME eq GTA5.exe"
                3⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:4332
              • C:\Windows\SysWOW64\findstr.exe
                findstr "GTA5.exe"
                3⤵
                  PID:4432
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist /FI "IMAGENAME eq launcher.exe"
                  3⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1840
                • C:\Windows\SysWOW64\findstr.exe
                  findstr "launcher.exe"
                  3⤵
                    PID:4824
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 20
                    3⤵
                    • Delays execution with timeout.exe
                    PID:4656
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 15
                    3⤵
                    • Delays execution with timeout.exe
                    PID:4688
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4192 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
                1⤵
                  PID:1504

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\Luna__GTA_Launcher_Rockstar_Edition.bat

                  Filesize

                  4KB

                  MD5

                  23e2b3e0f516e9f59e1de5dde888c188

                  SHA1

                  499e8c8b4f0a175d0a1e54b62932b197b5abe822

                  SHA256

                  2be6713e465141b7aaa85a2a5b3489b0c4540b40e1af2b7b9e970e74fb179a56

                  SHA512

                  34058e5a174ef402bf95198ccffa2a475cde9b8e7cf87577cdca488e53ef64db00bbe162900a25796827be30636d7e8c31dadfa388a6b997588166ac35b165be

                • memory/3936-0-0x0000000000400000-0x000000000041C000-memory.dmp

                  Filesize

                  112KB

                • memory/3936-4-0x0000000000400000-0x000000000041C000-memory.dmp

                  Filesize

                  112KB