Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2acd29182f...18.exe

windows7-x64

7

2acd29182f...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/07/2024, 03:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2acd29182f1e1b035d72d458384c5dc8_JaffaCakes118.exe

  • Size

    448KB

  • MD5

    2acd29182f1e1b035d72d458384c5dc8

  • SHA1

    ec1009782db3417b1c7f40a7920096558bd7aab3

  • SHA256

    9099e4c867fae761db538a9b5e44dc6d411c3d453d0f1f5b590075d0a61fdf0d

  • SHA512

    fb6e7bca8f22217e16df4f665ba826c54ba352f333fe2f2785b7f965c28b21b2ae90220f640b9d61cd8a2182dc7cba4cec65557d0e3c01778dec57fbc18559d3

  • SSDEEP

    6144:WmW1E00/Z7JAUjE1GiPjTDHIXlNFucTdLP8ywiAAMT1BsQMIs:WmQE0gZ7JP2HA3Fu6ii6BsQ4

Score
7/10
persistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2acd29182f1e1b035d72d458384c5dc8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2acd29182f1e1b035d72d458384c5dc8_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3376
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 668
      2⤵
      • Program crash
      PID:4200
    • C:\ProgramData\mI01804KlPjI01804\mI01804KlPjI01804.exe
      "C:\ProgramData\mI01804KlPjI01804\mI01804KlPjI01804.exe" "C:\Users\Admin\AppData\Local\Temp\2acd29182f1e1b035d72d458384c5dc8_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3080
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 668
        3⤵
        • Program crash
        PID:4108
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3376 -ip 3376
    1⤵
      PID:2456
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3080 -ip 3080
      1⤵
        PID:2800

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\mI01804KlPjI01804\mI01804KlPjI01804
        Filesize

        192B

        MD5

        08ee8df8d2ef0eac6be18fe511c2fc42

        SHA1

        ed0b33f12b8e1babcb13e72fa67375f7c849d1b7

        SHA256

        e591b7773a1868c06233fce023ca7b62bf6094f4f30997ec7d972643e94fd563

        SHA512

        5f4c42716d93bb96e903ad406ebaa8a15ce6c340a895757e377d43e9a42760ba405546e15790b674c905d9e25908dc2f9e406a619974e45b5e1901e82ddbadc4

        Download Submit

      • C:\ProgramData\mI01804KlPjI01804\mI01804KlPjI01804.exe
        Filesize

        448KB

        MD5

        2391ac952d6da6cab1ba9977bb0c0da6

        SHA1

        f18838a018710a44051d278bb1f054aaf16f77bd

        SHA256

        05d58f0a842de0201f137c7478389f2f28d1dd12ad08d3d64793563f6e3cd1ba

        SHA512

        acc39bcc034c1d1e424de6c90ac1583b173c1400766a1be0908d1b1aaf5917fdd2fb271cd0c663c855d372838d289a8ef13e9de2a02050cd8a0ec43dab255ae4

        Download Submit

      • memory/3080-15-0x0000000000400000-0x00000000004F2000-memory.dmp

        Filesize

        968KB

        Download

      • memory/3080-21-0x0000000000400000-0x00000000004F2000-memory.dmp

        Filesize

        968KB

        Download

      • memory/3080-24-0x0000000000400000-0x00000000004F2000-memory.dmp

        Filesize

        968KB

        Download

      • memory/3080-31-0x0000000000400000-0x00000000004F2000-memory.dmp

        Filesize

        968KB

        Download

      • memory/3376-0-0x0000000002130000-0x0000000002132000-memory.dmp

        Filesize

        8KB

        Download

      • memory/3376-3-0x0000000000400000-0x00000000004F2000-memory.dmp

        Filesize

        968KB

        Download

      • memory/3376-14-0x0000000000400000-0x00000000004F2000-memory.dmp

        Filesize

        968KB

        Download