Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/06/2024, 16:40

General

  • Target

    07d8d2d2b22f92953aec1dadc11f736f_JaffaCakes118.exe

  • Size

    274KB

  • MD5

    07d8d2d2b22f92953aec1dadc11f736f

  • SHA1

    7cf6d79b608f11e47f3a0a96712a56ba56058ca2

  • SHA256

    4befcf1607bb074834cb9367d1be4b9cf78389b49922e4668e3b50dd013f2a24

  • SHA512

    8630254d94784b3d5d890d64cec1b60ffc3a5a2836dc40e2cef65e4d6deaa981b8055b494c4f328c5dd5c827463906cf8d3913448fa1a81d4abf0421e308c70c

  • SSDEEP

    6144:EoWwI7+d6+1M/WSW+VTcg+UP+Uzshr/ict25j/6IM0b4+2F:EoWbW14nTTcgCU4p6Avo4+g

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:624
    • C:\Users\Admin\AppData\Local\Temp\07d8d2d2b22f92953aec1dadc11f736f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\07d8d2d2b22f92953aec1dadc11f736f_JaffaCakes118.exe"
      1⤵
      • Modifies WinLogon for persistence
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3604
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3376 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:2104

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/624-50-0x0000000011570000-0x0000000011596000-memory.dmp

        Filesize

        152KB

      • memory/624-19-0x0000000011450000-0x0000000011476000-memory.dmp

        Filesize

        152KB

      • memory/624-102-0x0000000011750000-0x0000000011776000-memory.dmp

        Filesize

        152KB

      • memory/624-96-0x0000000011720000-0x0000000011746000-memory.dmp

        Filesize

        152KB

      • memory/624-9-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/624-14-0x0000000011420000-0x0000000011446000-memory.dmp

        Filesize

        152KB

      • memory/624-46-0x0000000011540000-0x0000000011566000-memory.dmp

        Filesize

        152KB

      • memory/624-23-0x0000000011480000-0x00000000114A6000-memory.dmp

        Filesize

        152KB

      • memory/624-31-0x00000000114B0000-0x00000000114D6000-memory.dmp

        Filesize

        152KB

      • memory/624-36-0x00000000114E0000-0x0000000011506000-memory.dmp

        Filesize

        152KB

      • memory/624-89-0x00000000116F0000-0x0000000011716000-memory.dmp

        Filesize

        152KB

      • memory/624-38-0x0000000011510000-0x0000000011536000-memory.dmp

        Filesize

        152KB

      • memory/624-69-0x0000000011630000-0x0000000011656000-memory.dmp

        Filesize

        152KB

      • memory/624-53-0x00000000115A0000-0x00000000115C6000-memory.dmp

        Filesize

        152KB

      • memory/624-62-0x00000000115D0000-0x00000000115F6000-memory.dmp

        Filesize

        152KB

      • memory/624-66-0x0000000011600000-0x0000000011626000-memory.dmp

        Filesize

        152KB

      • memory/624-85-0x00000000116C0000-0x00000000116E6000-memory.dmp

        Filesize

        152KB

      • memory/624-74-0x0000000011660000-0x0000000011686000-memory.dmp

        Filesize

        152KB

      • memory/624-80-0x0000000011690000-0x00000000116B6000-memory.dmp

        Filesize

        152KB

      • memory/3604-0-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/3604-1-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/3604-3-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/3604-2-0x0000000000410000-0x0000000000412000-memory.dmp

        Filesize

        8KB

      • memory/3604-3020-0x0000000000410000-0x0000000000412000-memory.dmp

        Filesize

        8KB