Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 09:48

General

  • Target

    2580bada454c4122a45bea952689ca34_JaffaCakes118.exe

  • Size

    100KB

  • MD5

    2580bada454c4122a45bea952689ca34

  • SHA1

    077bdb34f838a6435a91b6b4dfaf5676a5183123

  • SHA256

    d5b684aa2e6429f35eb0b0d30c8a0736e162308631cc5b48849a26b4e22f57cf

  • SHA512

    632d58d4e9d3ad4802f4f809f9f990f3302b6e25dacf1ae926bec2eda13dfc94eae5a09fc085439957952d510d2848dee1f1a4055631acf9ba9b31beb27c4764

  • SSDEEP

    1536:n1KyFqi3M61vdAQzdV6t5oYdMSqYqGnqEUkgCizOB:Qa8OrJVEZMSPv

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2580bada454c4122a45bea952689ca34_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2580bada454c4122a45bea952689ca34_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4584
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\2580bada454c4122a45bea952689ca34_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\Temp\file.rst"
      2⤵
        PID:2916
      • C:\Windows\SysWOW64\cmd.exe
        cmd
        2⤵
          PID:4012
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 12
            3⤵
            • Program crash
            PID:2164
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4012 -ip 4012
        1⤵
          PID:1096

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\file.rst

          Filesize

          100KB

          MD5

          2580bada454c4122a45bea952689ca34

          SHA1

          077bdb34f838a6435a91b6b4dfaf5676a5183123

          SHA256

          d5b684aa2e6429f35eb0b0d30c8a0736e162308631cc5b48849a26b4e22f57cf

          SHA512

          632d58d4e9d3ad4802f4f809f9f990f3302b6e25dacf1ae926bec2eda13dfc94eae5a09fc085439957952d510d2848dee1f1a4055631acf9ba9b31beb27c4764

        • memory/4012-6-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/4012-7-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/4012-5-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB