Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2024, 09:00

General

  • Target

    1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe

  • Size

    124KB

  • MD5

    1ab12ca1fb9180ff8fac937066e843a5

  • SHA1

    b01b189363d4c5c25af763abd3b769178ec43abd

  • SHA256

    cb9411230c903f1df0b7d44bed1efe29da8605fdb29d589bdc3fa7d8d74f9768

  • SHA512

    804bd6ad7a3084c42ef3ce13f9de270d8e499d7f530c422bb3a6f822571296ee85700ebd8fda78eb5f2b86bebd641d11b430211cf47e02f2a4514202f94649ed

  • SSDEEP

    3072:KV4nc90YgA4ZKsup/mnU9xw0W/Pgd+vI14:c4nciYg9nUDq/PE4

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Runs net.exe
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3092
    • C:\Windows\SysWOW64\net.exe
      net start mswinlogonprocservice
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4636
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 start mswinlogonprocservice
        3⤵
          PID:1708
      • C:\Windows\SysWOW64\regedit.exe
        regedit -s C:\Windows\disable.reg
        2⤵
        • Modifies firewall policy service
        • Windows security bypass
        • Runs .reg file with regedit
        PID:4976

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\disable.reg

      Filesize

      1KB

      MD5

      95de2ee9e174d0a77debf3280514aed6

      SHA1

      6f8909c33161711004142e796f7a4f3eba154af1

      SHA256

      231452b77c342dc4fb3c03c9ae01ae4fb6e118cc9a62b79fe1eab126c7fc8190

      SHA512

      7f815ee0da6aaa41e084e8df773ec45d108a611f0a726eb7746d4fe7012b7b2a245f57d275258968d5d21dc0c30410eab40fb672c6051eccf3e7c3875c325268

    • memory/3092-0-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB