Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

34c80baa43...18.exe

windows7-x64

7

34c80baa43...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 12:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    34c80baa4305387eb70ae9aba0da833e_JaffaCakes118.exe

  • Size

    448KB

  • MD5

    34c80baa4305387eb70ae9aba0da833e

  • SHA1

    065a6b67ca3b0c035edfe943459df9381f28e1d7

  • SHA256

    269ee548ec13e1973b361783869a7168d6ea8e9866d217aecc89644fcf3b9474

  • SHA512

    a0ebf50ddae69aa1679a1f89099c3224f13298a176b388a70172db821cd60f68be2b68444964ec262e8fe18c34892137b353768e40fe51e849d0e4b77c67cea8

  • SSDEEP

    12288:/zOFZykd4pU9AUV6EQhrfV+Fu6Q+0MC3VTJKc4:bkR6pU6UQEgrf//yANKD

Score
7/10
persistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34c80baa4305387eb70ae9aba0da833e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\34c80baa4305387eb70ae9aba0da833e_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 676
      2⤵
      • Program crash
      PID:2892
    • C:\ProgramData\mL28601JoFkL28601\mL28601JoFkL28601.exe
      "C:\ProgramData\mL28601JoFkL28601\mL28601JoFkL28601.exe" "C:\Users\Admin\AppData\Local\Temp\34c80baa4305387eb70ae9aba0da833e_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3500
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 668
        3⤵
        • Program crash
        PID:1708
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3188 -ip 3188
    1⤵
      PID:2520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3500 -ip 3500
      1⤵
        PID:4636

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\mL28601JoFkL28601\mL28601JoFkL28601
        Filesize

        192B

        MD5

        18ba421ee3e3d2ba797fa51418fb8490

        SHA1

        3be91f23fff0d9266da234e06e24daf79f0be34f

        SHA256

        e2a7a1fe7714bda21e78e87a4f32e6834720874e60390d9969461effcee1aa43

        SHA512

        9cf7e20894edef6f0fad3f1d724c3ae117687cda1f590cfaf931c10b7972a713149f6b8e7a6cfeb3c2e171d0620753eea674fd6f37bb73d7a7cc725ce68c3d13

        Download Submit

      • C:\ProgramData\mL28601JoFkL28601\mL28601JoFkL28601.exe
        Filesize

        448KB

        MD5

        87a84ad3c23bc1309571f02c1db10d6c

        SHA1

        3277fe7954ae00d4a8a9e01efeb50cebbf4da602

        SHA256

        5f455918fc94d551213f77d847c5c775b6039ee162bd7f843ec0c81b43102fdc

        SHA512

        0f9d7e12eae19d42abb9d57ac437cdcfa70c1a37d723284ac874b71464b33313ed3dd9d2933ee47fce83fd5550a3d673fc45477162ba7ef9b4512655c5c8383b

        Download Submit

      • memory/3188-0-0x0000000002270000-0x0000000002272000-memory.dmp

        Filesize

        8KB

        Download

      • memory/3188-6-0x0000000000400000-0x00000000004F2000-memory.dmp

        Filesize

        968KB

        Download

      • memory/3188-12-0x0000000000400000-0x00000000004F2000-memory.dmp

        Filesize

        968KB

        Download

      • memory/3500-14-0x0000000000400000-0x00000000004F2000-memory.dmp

        Filesize

        968KB

        Download

      • memory/3500-20-0x0000000000400000-0x00000000004F2000-memory.dmp

        Filesize

        968KB

        Download

      • memory/3500-23-0x0000000000400000-0x00000000004F2000-memory.dmp

        Filesize

        968KB

        Download

      • memory/3500-30-0x0000000000400000-0x00000000004F2000-memory.dmp

        Filesize

        968KB

        Download