Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 08:59

General

  • Target

    7176535c0c9c18724cc8780ae0c6218d_JaffaCakes118.exe

  • Size

    718KB

  • MD5

    7176535c0c9c18724cc8780ae0c6218d

  • SHA1

    d24614e7c1017e857809c708db40038ac78a5775

  • SHA256

    76ff7dff54096527c1fd37e41d7c42d9cdf96545b6b7492ef12f64039617498b

  • SHA512

    b3d64137f14b555afc49128a6d98ec441fc15c9c217208af717c91a3320a653815debd6a8e82b14adc831c32b10faede3b4bd7d03a42ece8d6e0fa8c65f46f2b

  • SSDEEP

    12288:r6vpyEBSvSsiaKzmoXQNARatosB8E+VZKytOzw4Pbv8+YRNAsqOAU7:r6vcENaKiKQNvW9ZVkyt6w4Pbv8+FsDP

Score
7/10

Malware Config

Signatures

  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7176535c0c9c18724cc8780ae0c6218d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7176535c0c9c18724cc8780ae0c6218d_JaffaCakes118.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\bootstrap_56329.html

    Filesize

    156B

    MD5

    1ea9e5b417811379e874ad4870d5c51a

    SHA1

    a4bd01f828454f3619a815dbe5423b181ec4051c

    SHA256

    f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

    SHA512

    965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\css\main.css

    Filesize

    8KB

    MD5

    001f0b28fb11638dfaf5412e156b82f2

    SHA1

    7442a74c768ed75bb6fc8bbe0ed9679ad1f8cf7e

    SHA256

    ad8cc29ecda16f4087820e815c38f3ae40f27b2b2cc90aef8d7a956bc1c5f2b5

    SHA512

    203fcda0ca0bc1b8730a107688214948d6b97a52e0f0a2e9dcdce54c6197463061ccf81931a56bf30faee4c301e76fc5df37b3895cf5c51e7ff4c21da7aced1d

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\css\sdk-ui\progress-bar.css

    Filesize

    506B

    MD5

    5335f1c12201b5f7cf5f8b4f5692e3d1

    SHA1

    13807a10369f7ff9ab3f9aba18135bccb98bec2d

    SHA256

    974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda

    SHA512

    0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\images\BG.png

    Filesize

    2KB

    MD5

    c8832698af9afcad56acd4480d89f82b

    SHA1

    ff0e5fabe4efa28a3bf716ed94f74179df7ef8c4

    SHA256

    7fc9a29cd4869e73fcc0d82c4235daeceb0456c6eeafc948c9ce6b5e4dbf8942

    SHA512

    a1f09051dafc43403b2946a81c645e2456e6bc09d6c66eba46fa6d8d0ac6f136e775811abae6747cbd40055773c4c6d45d8b7e6240c8cd9ec40a1fc5452f4e96

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\images\Close.png

    Filesize

    207B

    MD5

    f5bdb3cabdc15580d97fa94aa3397c08

    SHA1

    d73b3bc67c9fe124768697cee7eec84c2b1eee4f

    SHA256

    b28db98f2a6b06b6783b8fca6aabdcb89234d5bd4306fa71711988dba1fc71ea

    SHA512

    511de8d97853457a37f89550f4b283ed69c05efdb7ce63657bc53b4e37ddf357577738be92da4bcd736d9c3c181c5ffc50b890c8cd5aa27099a87acf2c600fad

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\images\Color_Button.png

    Filesize

    863B

    MD5

    aebc9f7755027a8790663b5d74088c42

    SHA1

    d567455a3e106cd5f456b1b0f395a0d0336aaa27

    SHA256

    b3f34c560de55adc8c9eadef4a7779f2d2e6ee0997c340d8f10a8dda63c86696

    SHA512

    53d4ce45e5c943c11d7951bc9f6563d3365ce36786ddc952bf6b3469b46a2c326410da29aff1061b21800b1cfff3088e3f3dfcad9f34a0962d069dd3a6fea3ee

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\images\Grey_Button.png

    Filesize

    1KB

    MD5

    aa1424f218bf3befbcca3c4c0e42a365

    SHA1

    c91d5dce4ebd543d905026577f8a05dff1d8357e

    SHA256

    e1a823582add59d1406fd36d3f7f86f98873e3201168e542cb49239d6c525ab0

    SHA512

    8ef2ea9613ff50bf028c9ef4611326d61b1cd07d01b89631faa2053449fab9a746e06e59a176dd5cda4f02f77fca8eedbb6e46ae4a78afa416ae8adb7ef0d93b

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\images\Loader.gif

    Filesize

    10KB

    MD5

    57ca1a2085d82f0574e3ef740b9a5ead

    SHA1

    2974f4bf37231205a256f2648189a461e74869c0

    SHA256

    476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e

    SHA512

    2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\images\Pause_Button.png

    Filesize

    577B

    MD5

    84b37cb510f50c8fea812eb308d3f03f

    SHA1

    d141a79feb407506709f051e55c55438a12fd3b4

    SHA256

    7bf800336671204de36b7d1f6ceffdff830040f51d21bc44f220f68d72cf492b

    SHA512

    3222cb5772a4e9b20de253914c0856c7e6383567df68fcf287801f6f79248f65957515e7ec4a44db1fbe910afeae8ca3349295c4bdf03df6aabde36f2aaa6b5e

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\images\Progress.png

    Filesize

    104B

    MD5

    35a600a752d3074501de31a516860499

    SHA1

    51eac62cf77a0b88a3e9cb9ee6f85def21fd4bcf

    SHA256

    14e064857751b23da7bbe40861ef4caf99b2496227507b8e3108fbac6d901f75

    SHA512

    046ec179571d239bfb2d51be9837f96d9afebf2e5db77bba0f4a25ce8716d37581a3f9753bd2dbb04c47711699a9d93987bceb71df0b8becf8c577d660320069

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\images\ProgressBar.png

    Filesize

    812B

    MD5

    eabb61abba55f80af418fa1128d1548d

    SHA1

    a5ee1d55de2cc60966039120c830fc19cefb0351

    SHA256

    717f3f02f5d5fd1478b6d2ec44acef6e70bb8f1adcf2dc030c08b92e851737e1

    SHA512

    d232072c9540bf0e2fd56f353c2cc83518eabf8282cc02d9f8bec81c0341287ada29ba79f2a515d68722658686b6cce97be138a48f44409562d9a567af200bd6

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\images\Quick_Specs.png

    Filesize

    221B

    MD5

    07cd59b954e8495ad6cd6a7c11d2de86

    SHA1

    787aeda3eee8053705fb208a6b399b8340820b82

    SHA256

    6e6b964fd79b4a3461f128e2ed145b9b641d108b8616695f36387661cae995bb

    SHA512

    0159aca0c2a49393fd91acd4b6819217e67f8fd01e220297eb3e0fdd8132fad794fc317f5cc5e2b761d4123da71478b97df776908de6740eb6d54187c6c00754

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\images\Resume_Button.png

    Filesize

    718B

    MD5

    9d31583bcfad58a6b9ddeaf44549a5e6

    SHA1

    98f4c693af708e02201de2aee31fe094dc3b0a9c

    SHA256

    e466a2db2f755d9eb68619439af37ff4e45559b7a3f476e226ab2a11aeadae1a

    SHA512

    9ddaaad53375f4d2874fe5c98b6782202d2bd975cdd9363796986dc7567368b94d9ec1aa3e839194097838b787bbd71d574540cf5b04fd04f10fa80d6a89e695

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\images\default_tb.png

    Filesize

    19KB

    MD5

    70e70599d4b853df0f12f6cb0e04695f

    SHA1

    6e3a721aef65625bf99b639800476150d262dd4b

    SHA256

    87af4027e8f89459463bdd73df7b928b883eefb20514159d3a1a4be0d39e00c0

    SHA512

    1efcf8af09cf857b3850cec43a88fc8c0992e3b04f78ad2c71b84c2ac7775e745df211582694588b29217aefb1ae02b29b94c2cfe52b5d32bdafb9dce73b9920

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\images\default_wi.png

    Filesize

    27KB

    MD5

    1cc2677e3e29e45e538985839cff2b42

    SHA1

    2dab653eb20be72b034a38dc1fcebbd18f079c86

    SHA256

    9216d98a6574dfadacdc8321dc435454cb72c589b3ee8326a9b946966f756d7f

    SHA512

    25575fea9abb1491b5a5853244a9b655ce05f64d98f4b79134674f2d9a560a5af405c1783c9da4a07cfb38b51d060c7a70890c70df6c1c8f4b01e041aa4f649f

  • C:\Users\Admin\AppData\Local\Temp\ish240598359\images\sponsored.png

    Filesize

    2KB

    MD5

    e3758d529f93fee4807f5ea95fbc1a6c

    SHA1

    3a9a1ba234e613e5f808c3ffeda05a10a5dafe00

    SHA256

    8d46eb0c60043dcb7d79ab3d0525148fc901764620c02e4b9c5dd8b0e9026303

    SHA512

    e891552bee3aa10247cad1fcc510331077016a6e71d46827be2dd46017f943c5acc2c1506b41217880d35d52a94989923ad0a345f8791da4bb379eceefe3c407

  • memory/2948-161-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-1-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2948-172-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-169-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-168-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-166-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-167-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-165-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-160-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-171-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-159-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-158-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-7-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-6-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-5-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-2-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB

  • memory/2948-0-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/2948-212-0x00000000020F0000-0x0000000002252000-memory.dmp

    Filesize

    1.4MB