Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 12:17

General

  • Target

    3057a9c81d160f233d5d05852215db86_JaffaCakes118.exe

  • Size

    42KB

  • MD5

    3057a9c81d160f233d5d05852215db86

  • SHA1

    198cbc83c1fdf94cc64289b47dce10f6978d02a7

  • SHA256

    7a948aca32cc9a7c561e8076618ca4e409dea9c44a09ec23473c83d3ee26bd81

  • SHA512

    8aa51c1e9c0bafeb04044c7511bdf985796eaa2ec851b91a45eed26140d1b9b7eeaa3405d8a4f9516cbdec68bfb21ccd51e048fba239cfddb4b8fdf82274b462

  • SSDEEP

    768:IPFx9OUeE4OFJLPbMxoghfi+00/Fx6letzRTSTRVI06YqA9ocpenI0R5WDrn:2x9OUevOFJrbHgNO+f2MFsHI06Vso008

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3057a9c81d160f233d5d05852215db86_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3057a9c81d160f233d5d05852215db86_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:4960
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x520 0x518
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\BASSMOD.dll

    Filesize

    13KB

    MD5

    2c6b7c20c138b7862eba1c8f35bbe429

    SHA1

    8f3e602eae82203c5a783db2571daf49a9e712a4

    SHA256

    ed5368c731c9e551a321f646917e2cf720523b13ec45d07cd88fbc1595d12c46

    SHA512

    b662d49d9f714d277c7b853e53ed402c973a8dc808b763c1307708985a5ecc098d1bccfbd20cb49d0c51b6c1289b756ff4161662f2513579d537dd3a851cc31a

  • memory/4960-0-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/4960-5-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB