Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 22:05

General

  • Target

    0fb29b50f47328bf2a4038d8b40bccea_JaffaCakes118.exe

  • Size

    806KB

  • MD5

    0fb29b50f47328bf2a4038d8b40bccea

  • SHA1

    9fff9224f851f91839afafef2053cf4560485718

  • SHA256

    87fa887af09d4c52dc30ad291a560f1a065cbdd0c471ac35826335fef445d679

  • SHA512

    98f2ae82302b5ca7518b45626c158e1d9cff798b0d614a79e452f83d6ed8a399662e2a1b0d3f62db28fc76ce7d35b18aaadacee2f6f23b28eb1b82839d8561be

  • SSDEEP

    24576:bIqlqVa5feL/aFJijg28TmNLmHEnN6lk:bIqI6fe2FAjgd63u

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fb29b50f47328bf2a4038d8b40bccea_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0fb29b50f47328bf2a4038d8b40bccea_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    PID:3292
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x3cc 0x46c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bassmod.dll

    Filesize

    33KB

    MD5

    e4ec57e8508c5c4040383ebe6d367928

    SHA1

    b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

    SHA256

    8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

    SHA512

    77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

  • memory/3292-15-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-21-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-6-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-9-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-8-0x0000000000400000-0x000000000055C000-memory.dmp

    Filesize

    1.4MB

  • memory/3292-11-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-13-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-1-0x00000000001D0000-0x00000000001D3000-memory.dmp

    Filesize

    12KB

  • memory/3292-0-0x0000000000400000-0x000000000055C000-memory.dmp

    Filesize

    1.4MB

  • memory/3292-17-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-19-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-23-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-25-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-27-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-29-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-31-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-33-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/3292-35-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB