Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 15:10

General

  • Target

    093e0bd790a760b524041866f3938a2b_JaffaCakes118.exe

  • Size

    8KB

  • MD5

    093e0bd790a760b524041866f3938a2b

  • SHA1

    50d6db422282892b3e7882c6f500ea3219708375

  • SHA256

    5337082c0319716b7693eaeed4dd07ca0372afafe133ae4b43c7ae825cdd101a

  • SHA512

    bd5893b4a5d8fbda8070ff7f43d0918287f5a7cbe61b45caba88741fae1cd4acdc23dc3085c60cd7753d6c7760c82f056eaefd3f5048a8f91488c02a2dacbe71

  • SSDEEP

    192:u5EaobyKKQJEA6PLvWA3hviLHPkA1yhupDdKR:u5L4RKQJEA6TWIpiTcAw0pg

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\093e0bd790a760b524041866f3938a2b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\093e0bd790a760b524041866f3938a2b_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • System policy modification
    PID:2196
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 472
      2⤵
      • Program crash
      PID:2632
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 732
      2⤵
      • Program crash
      PID:3408
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2196 -ip 2196
    1⤵
      PID:3900
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2196 -ip 2196
      1⤵
        PID:4680

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SYSHOST.DLL

        Filesize

        5KB

        MD5

        3bddcd7aa3c3630c7f6a138f5b9c41b0

        SHA1

        409e7aac7d3cb361811a316e529ef605f8199390

        SHA256

        ccfb019f537ae9165495ae087d8b90930db8bec75535ad5efc59917c08fdae90

        SHA512

        e21c5290502ec7d60662ca92ac4854e061a1214ced15815c3e62d49969f0f31798d0094fb4502de6fd72e64801557a730fc50e2f2139ecb2de1924ae68b036f9

      • memory/2196-0-0x0000000000400000-0x0000000000408000-memory.dmp

        Filesize

        32KB

      • memory/2196-7-0x0000000000670000-0x0000000000675000-memory.dmp

        Filesize

        20KB

      • memory/2196-8-0x0000000000400000-0x0000000000408000-memory.dmp

        Filesize

        32KB