Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/07/2024, 08:48

General

  • Target

    2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe

  • Size

    300KB

  • MD5

    2bb4c657c34f640c087cf2018f48184d

  • SHA1

    b4d98b6d2fc5682711f458bdfe8c7af838c60f41

  • SHA256

    b8bf8b9e823702e4028c3dc2bd6f1cac5b47bbed044479e6731972ca0db9f4a3

  • SHA512

    25579ee06d7a1bc8dbf1e53f46494b0958ff3afa010920bcc45c56c6cc03f39f7dfe43b8c21de50033caad8258d6da86282e69bf6f8a840b8de727943b1f30a9

  • SSDEEP

    6144:jp1eHtHuPdq1i/qwdm+4ddvSLKv/xesM3QVfway9c3sKGeygTp2yFQ:tANHuPQ1AB2DhesM3ufwjO3ODgjFQ

Score
7/10

Malware Config

Signatures

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Users\Admin\AppData\Local\Temp\2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe"
      2⤵
        PID:4944

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4604-0-0x00000000749B2000-0x00000000749B3000-memory.dmp

      Filesize

      4KB

    • memory/4604-1-0x00000000749B0000-0x0000000074F61000-memory.dmp

      Filesize

      5.7MB

    • memory/4604-2-0x00000000749B0000-0x0000000074F61000-memory.dmp

      Filesize

      5.7MB

    • memory/4604-11-0x00000000749B0000-0x0000000074F61000-memory.dmp

      Filesize

      5.7MB

    • memory/4944-3-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4944-6-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4944-9-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB