Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 11:47

General

  • Target

    0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe

  • Size

    164KB

  • MD5

    0df3318d819d9ad6ebd2a967f1e98813

  • SHA1

    5072f8aed37a42d820ba58472dfc48ba02dad908

  • SHA256

    286c8d67eac594e9b15b554607c9c8a9a3c72cc99c0d7a62e15b74c9ec5a3253

  • SHA512

    2a1366573abcea264470ef34a1c38319db5d65d9260943751943571bd18ba84fc6768d9453b37be8aed843039ff5fff8f365b7fa9fe425d45051207668e3a501

  • SSDEEP

    3072:h8JoE0ABLF7U9/IjKZcg3T4pxyLaQFiAXCgRdAesXGDQghH/cE:UiWFGcg6AiIRuBXAf

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of WriteProcessMemory
    PID:3176
    • C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe startC:\Program Files (x86)\LP\BC6D\396.exe%C:\Program Files (x86)\LP\BC6D
      2⤵
        PID:2520
      • C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe startC:\Program Files (x86)\9C5A3\lvvm.exe%C:\Program Files (x86)\9C5A3
        2⤵
          PID:964
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3168 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4488

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\D8A9C\C5A3.8A9

          Filesize

          996B

          MD5

          0eed4be1e009f8234b12186f0e751945

          SHA1

          e919e7a8137f76cf9ba2ce9115a6af6a604fefb2

          SHA256

          7846a64eab20d1b0c18f4f3f6d5eeb78e8c798782a6abc6136f7cb608c2e9e2b

          SHA512

          d8b9ec5dd176a57b69f34f3efffeb01f6b8c8b34fc85098f070484d73f7fd27b64b6cdbb580322a4a7511be6c13e43b937f096df148cee05a26dd69bd0a96d3d

        • C:\Users\Admin\AppData\Roaming\D8A9C\C5A3.8A9

          Filesize

          600B

          MD5

          58af57985f6ccea257658f2911252cd5

          SHA1

          e6dcc622f78ce7afa174fb8c471ff7fe000fe86b

          SHA256

          0eb17eb931d09065947aa381f84599c7e537e483ed7eaf5a299c552a5355d868

          SHA512

          25ef335a63beb0092227dff2522f0b1237e2ecf9d1891e2bc2156db557ce034a65b3785f630a5e7cd17b215b2c6a7a74b4e10718ad55b37ab24e60e0881f3a3e

        • memory/964-196-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/964-194-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/2520-14-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/2520-17-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/2520-15-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/3176-18-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/3176-0-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/3176-3-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/3176-197-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/3176-198-0x0000000000400000-0x000000000048E000-memory.dmp

          Filesize

          568KB

        • memory/3176-2-0x0000000000400000-0x000000000048E000-memory.dmp

          Filesize

          568KB

        • memory/3176-310-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB