Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 00:15

General

  • Target

    053cf238e7934c1472fd6e99f73d8aa7_JaffaCakes118.exe

  • Size

    582KB

  • MD5

    053cf238e7934c1472fd6e99f73d8aa7

  • SHA1

    785512e3b6521d75de938be8745bfec6c6523d18

  • SHA256

    d2d9a048e2543d8c41c8db1683f6872472b4253cca2ca21fb4db6fe7113b0b66

  • SHA512

    acdbaed925d335e09c17cfe3bf480ac7e5a51bc552eb3a3eb60b0752555504decdb81a29403b9d95abf66cab22c220fd44d756275639f3b8c511d4beb0ced7c4

  • SSDEEP

    12288:hYFBsdyQrOz4uwSI+KoiwMZPzPFQuh3a7KWh0ZPPD5VoxtFakcekVMWfJ:hfyaA75I+1gzPFQAyPhkXDCSBerWfJ

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\053cf238e7934c1472fd6e99f73d8aa7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\053cf238e7934c1472fd6e99f73d8aa7_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1396
  • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1816

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1396-0-0x0000000002300000-0x0000000002301000-memory.dmp

    Filesize

    4KB

  • memory/1396-542-0x0000000002300000-0x0000000002301000-memory.dmp

    Filesize

    4KB

  • memory/1396-105-0x0000000000400000-0x00000000005A9000-memory.dmp

    Filesize

    1.7MB

  • memory/1816-83-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB

  • memory/1816-87-0x00007FFB2DCC0000-0x00007FFB2DCD0000-memory.dmp

    Filesize

    64KB

  • memory/1816-75-0x00007FFB7052D000-0x00007FFB7052E000-memory.dmp

    Filesize

    4KB

  • memory/1816-73-0x00007FFB30510000-0x00007FFB30520000-memory.dmp

    Filesize

    64KB

  • memory/1816-78-0x00007FFB30510000-0x00007FFB30520000-memory.dmp

    Filesize

    64KB

  • memory/1816-79-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB

  • memory/1816-80-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB

  • memory/1816-81-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB

  • memory/1816-82-0x00007FFB2DCC0000-0x00007FFB2DCD0000-memory.dmp

    Filesize

    64KB

  • memory/1816-76-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB

  • memory/1816-84-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB

  • memory/1816-74-0x00007FFB30510000-0x00007FFB30520000-memory.dmp

    Filesize

    64KB

  • memory/1816-86-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB

  • memory/1816-88-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB

  • memory/1816-89-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB

  • memory/1816-85-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB

  • memory/1816-91-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB

  • memory/1816-92-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB

  • memory/1816-90-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB

  • memory/1816-77-0x00007FFB30510000-0x00007FFB30520000-memory.dmp

    Filesize

    64KB

  • memory/1816-72-0x00007FFB30510000-0x00007FFB30520000-memory.dmp

    Filesize

    64KB

  • memory/1816-543-0x00007FFB70490000-0x00007FFB70685000-memory.dmp

    Filesize

    2.0MB