Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2024, 21:48

General

  • Target

    3ad62dbb3a75e3ed1ef4dcefe3e162ea_JaffaCakes118.exe

  • Size

    49KB

  • MD5

    3ad62dbb3a75e3ed1ef4dcefe3e162ea

  • SHA1

    4b7afc57108da57970c655645b35ba3c689cd724

  • SHA256

    0711eeff17dc30275d8b5a76b0e650aa305b79605c991aa555004645fc928766

  • SHA512

    085b77d7b2a7e9802e084fb348535f697c22537ef5d39ef46eedc8c9df9fbb8a90932e5a8ff8d7e72fa12bbbfb321276d2877755762efa4bcbaa1ff06b664233

  • SSDEEP

    768:VYV7Rmgxdyx7IOVs3YaEJUuXaOEAYD9eh0z77Kci5nbR9AnaUCa8GXfuIJJuk:VYpsgC7Rs4Uk8mMiRbR9AUd1k

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:624
    • C:\Users\Admin\AppData\Local\Temp\3ad62dbb3a75e3ed1ef4dcefe3e162ea_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3ad62dbb3a75e3ed1ef4dcefe3e162ea_JaffaCakes118.exe"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2112
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Windows\system32\cbXRKBrR.dll,a
        2⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:1184
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\mlJCTMcD.bat "C:\Users\Admin\AppData\Local\Temp\3ad62dbb3a75e3ed1ef4dcefe3e162ea_JaffaCakes118.exe"
        2⤵
          PID:2744

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\mlJCTMcD.bat

        Filesize

        63B

        MD5

        af5dedeb191631780afe3251f34d8799

        SHA1

        86a301b3b80745365227560cb72d548ee7b50655

        SHA256

        327033918c0800b5d3efb86e64db9109fdc686ed7564c77a4408915bb4d8324d

        SHA512

        82643be912e77329b041ef31a19543b5401996149d3dd5f840d0d4531a35b7477059d9ac48e3eb7f39a3308feafe74c16244e38a741c29bb98fc6f14c90d569e

      • C:\Windows\SysWOW64\cbXRKBrR.dll

        Filesize

        36KB

        MD5

        6078ae713210a6ca936e659a0ee77019

        SHA1

        f0750194a7afc6c2e3dab598348933c9447b15da

        SHA256

        987c44cc98f35beab26e8f292e87852610b8038ecd995aed0f9793baaf0697e4

        SHA512

        2e675de59a3d8bfab7d9dd6b9f0044418b51ff40ab3f9d3723a3f94a150a5de06e3692332be84d2290fcfe29589e9642bf4273fb245ea4267e3930037a4d0492

      • memory/1184-20-0x0000000000E80000-0x0000000000E85000-memory.dmp

        Filesize

        20KB

      • memory/1184-19-0x0000000010000000-0x0000000010015000-memory.dmp

        Filesize

        84KB

      • memory/1184-22-0x0000000010000000-0x0000000010015000-memory.dmp

        Filesize

        84KB

      • memory/2112-0-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/2112-1-0x0000000002170000-0x0000000002175000-memory.dmp

        Filesize

        20KB

      • memory/2112-2-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/2112-8-0x0000000010000000-0x0000000010015000-memory.dmp

        Filesize

        84KB

      • memory/2112-10-0x0000000010000000-0x0000000010015000-memory.dmp

        Filesize

        84KB

      • memory/2112-11-0x0000000002170000-0x0000000002175000-memory.dmp

        Filesize

        20KB