Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2b660ef15f...18.exe

windows7-x64

7

2b660ef15f...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    96s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/07/2024, 07:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2b660ef15fe01081fe07d5abe83c9b36_JaffaCakes118.exe

  • Size

    520KB

  • MD5

    2b660ef15fe01081fe07d5abe83c9b36

  • SHA1

    56b5597e22618f21d30586e621c5f276ea7c2931

  • SHA256

    426721efc81727101498320642651960b684dcc5546baf6881f6afac4fdf36c9

  • SHA512

    b46ff0415e8b762ee8deffbf349d92d2d95c0ec2f09c16f2a8c03f9d8307a30a391cae7e3ade6586052d03009d31b31043992a1685631cc043a66b4d56cc3079

  • SSDEEP

    12288:ydiM1Wtvs51uGnPOj7sJIdcu8sjI8UMty0ZazH:aidtE51hPOwISsRhy0A

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Program crash 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b660ef15fe01081fe07d5abe83c9b36_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2b660ef15fe01081fe07d5abe83c9b36_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:5072
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 220
      2⤵
      • Program crash
      PID:4080
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 260
      2⤵
      • Program crash
      PID:3792
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5072 -ip 5072
    1⤵
      PID:2264
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5072 -ip 5072
      1⤵
        PID:2980
      • C:\Windows\SysWOW64\winine.exe
        C:\Windows\SysWOW64\winine.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        PID:4588
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 216
          2⤵
          • Program crash
          PID:4052
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 236
          2⤵
          • Program crash
          PID:2696
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4588 -ip 4588
        1⤵
          PID:2448
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4588 -ip 4588
          1⤵
            PID:4496

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SysWOW64\winine.exe
            Filesize

            520KB

            MD5

            2b660ef15fe01081fe07d5abe83c9b36

            SHA1

            56b5597e22618f21d30586e621c5f276ea7c2931

            SHA256

            426721efc81727101498320642651960b684dcc5546baf6881f6afac4fdf36c9

            SHA512

            b46ff0415e8b762ee8deffbf349d92d2d95c0ec2f09c16f2a8c03f9d8307a30a391cae7e3ade6586052d03009d31b31043992a1685631cc043a66b4d56cc3079

            Download Submit

          • memory/4588-5-0x0000000000760000-0x0000000000761000-memory.dmp

            Filesize

            4KB

            Download

          • memory/5072-0-0x0000000002280000-0x0000000002281000-memory.dmp

            Filesize

            4KB

            Download