Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 17:14

General

  • Target

    0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe

  • Size

    237KB

  • MD5

    0ee37ea44c1573723346c13586fcac4c

  • SHA1

    030bd42c35207837a372cd1f0c13060c5f6a96e3

  • SHA256

    e9114d3a81bb51030cfdd32d36521cf2bf1d698b903412cc72e65788b71ecfee

  • SHA512

    6bfa1a42fa2ec0c76b4efc0fa3086d89007f92576c12e719e55089f6c8c7c602da15355bade47f35b4f073b68d08c814075d9e508018dcbaaa70b3833636ae66

  • SSDEEP

    6144:GmnWnJoOryJibLf69Vcc4gUA2vJCM/aBpURhmVWf0A6Fuwb:5W+GrbE94gH2vJCYRhDf0AA3b

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3280
    • C:\Windows\SysWOW64\notepad.exe
      C:\Windows\system32\notepad.exe
      2⤵
      • Adds Run key to start application
      PID:756
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4344,i,11049150160560877369,2866371920339304689,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:8
    1⤵
      PID:640

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\ProgramData\JkqkcsL\FcawicE\YmuptsE.exe

      Filesize

      237KB

      MD5

      0ee37ea44c1573723346c13586fcac4c

      SHA1

      030bd42c35207837a372cd1f0c13060c5f6a96e3

      SHA256

      e9114d3a81bb51030cfdd32d36521cf2bf1d698b903412cc72e65788b71ecfee

      SHA512

      6bfa1a42fa2ec0c76b4efc0fa3086d89007f92576c12e719e55089f6c8c7c602da15355bade47f35b4f073b68d08c814075d9e508018dcbaaa70b3833636ae66

    • memory/756-6-0x0000000000400000-0x00000000004BA000-memory.dmp

      Filesize

      744KB

    • memory/756-8-0x0000000002BE0000-0x0000000002BE3000-memory.dmp

      Filesize

      12KB

    • memory/756-7-0x0000000000400000-0x00000000004BA000-memory.dmp

      Filesize

      744KB

    • memory/756-11-0x0000000000400000-0x00000000004BA000-memory.dmp

      Filesize

      744KB

    • memory/756-13-0x0000000000400000-0x00000000004BA000-memory.dmp

      Filesize

      744KB

    • memory/756-14-0x0000000002C80000-0x0000000002C81000-memory.dmp

      Filesize

      4KB

    • memory/756-16-0x0000000000400000-0x00000000004BA000-memory.dmp

      Filesize

      744KB

    • memory/756-17-0x0000000002C80000-0x0000000002C81000-memory.dmp

      Filesize

      4KB

    • memory/3280-2-0x00000000005B0000-0x00000000005B1000-memory.dmp

      Filesize

      4KB

    • memory/3280-10-0x0000000000400000-0x00000000004BA000-memory.dmp

      Filesize

      744KB

    • memory/3280-0-0x0000000000400000-0x00000000004BA000-memory.dmp

      Filesize

      744KB

    • memory/3280-1-0x0000000000540000-0x0000000000543000-memory.dmp

      Filesize

      12KB