Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 14:58

General

  • Target

    30d866711c402b6a635213239a6ee299_JaffaCakes118.exe

  • Size

    50KB

  • MD5

    30d866711c402b6a635213239a6ee299

  • SHA1

    e5102fe0a20b9b63e309da3d748b032b97ef6074

  • SHA256

    893595dc6a4871753210511606d2881a26bb40a5cd70ec4f0c65630c233e6eb5

  • SHA512

    f0c284a7b12f446d0eac9d5403c929f63c28567ac3197b6de7e6b13df1da82511c7eb34396c81e3cf9caf0836ee940fc92daceca17c4200f9d7aa35d57fc7d7b

  • SSDEEP

    768:fvsEUoVH8RqYkgdrh1uON43V7oLQgbqwtzU3XH8Oci4nJGnReRAT2L6/zDbWxIF1:s2t8Rq6phXbcgbqOzxvngnReaiOziI3

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
    • C:\Users\Admin\AppData\Local\Temp\30d866711c402b6a635213239a6ee299_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\30d866711c402b6a635213239a6ee299_JaffaCakes118.exe"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1316
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Windows\system32\wvUkHYqn.dll,a
        2⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:2728
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\30d866711c402b6a635213239a6ee299_JaffaCakes118.exe"
        2⤵
          PID:932

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\removalfile.bat

        Filesize

        43B

        MD5

        9a7ef09167a6f4433681b94351509043

        SHA1

        259b1375ed8e84943ca1d42646bb416325c89e12

        SHA256

        d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7

        SHA512

        96b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df

      • C:\Windows\SysWOW64\nnnnLeCs.dll

        Filesize

        33KB

        MD5

        65a6bc84fccd148329869bd9380b97dc

        SHA1

        1b07cbfcd17b1c1fda84b06f4c352a350bcf582e

        SHA256

        770ffa9abb7f1ac8118984c550c8dd056e35e6a3727df47b3d3ed8b7f120f7dd

        SHA512

        8113d7b50b9e9ff9a96cf499d5071b19369b2c74e91ca64976f1ce61591d0171186207abac936675c5f1c1c9c4ff0fa7190040e4c1f0db0831d561e8076aa3cb

      • memory/1316-13-0x0000000010000000-0x0000000010014000-memory.dmp

        Filesize

        80KB

      • memory/1316-11-0x0000000010000000-0x0000000010014000-memory.dmp

        Filesize

        80KB

      • memory/1316-5-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/1316-4-0x0000000000408000-0x0000000000411000-memory.dmp

        Filesize

        36KB

      • memory/1316-3-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/1316-12-0x0000000010000000-0x0000000010014000-memory.dmp

        Filesize

        80KB

      • memory/1316-0-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/1316-2-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/1316-19-0x0000000010000000-0x0000000010014000-memory.dmp

        Filesize

        80KB

      • memory/1316-1-0x0000000002160000-0x000000000216B000-memory.dmp

        Filesize

        44KB

      • memory/2728-30-0x00000000012B0000-0x00000000012B6000-memory.dmp

        Filesize

        24KB

      • memory/2728-29-0x0000000010000000-0x0000000010014000-memory.dmp

        Filesize

        80KB

      • memory/2728-31-0x000000001000E000-0x0000000010013000-memory.dmp

        Filesize

        20KB

      • memory/2728-33-0x0000000010000000-0x0000000010014000-memory.dmp

        Filesize

        80KB

      • memory/2728-35-0x00000000012B0000-0x00000000012B6000-memory.dmp

        Filesize

        24KB