Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2024, 11:13

General

  • Target

    38e0cf78154dc3106a85822ea91a933b_JaffaCakes118.exe

  • Size

    961KB

  • MD5

    38e0cf78154dc3106a85822ea91a933b

  • SHA1

    17eab8af533e2edcf271be04ee1bec3771336e7e

  • SHA256

    02786fbf22b3a946ecf8eaae05127fb616d8f12ec94aa9a669e7897a71aee7d9

  • SHA512

    e209dfda4a79ba00ad74df6818954a5a2e1db8534344b59c7c16c6e9bd1e53ad24edf3c3cbefcb68cde57a7d26d089bbb1eec047dd09cd634b997ece1704b3e3

  • SSDEEP

    12288:NXWK/zuOn6PITSvUG+T8E3tDUcJF1TjSoYQNTF3Z4mxxNniRhTqKTq7FFg0gkR:hWTmyx+Th3zVXYQNTQmXRiRhu2qTg0g2

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3612
      • C:\Users\Admin\AppData\Local\Temp\38e0cf78154dc3106a85822ea91a933b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\38e0cf78154dc3106a85822ea91a933b_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
          3⤵
            PID:452
      • C:\Windows\L_Server2007.exe
        C:\Windows\L_Server2007.exe
        1⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2720

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\L_Server2007.exe

        Filesize

        961KB

        MD5

        38e0cf78154dc3106a85822ea91a933b

        SHA1

        17eab8af533e2edcf271be04ee1bec3771336e7e

        SHA256

        02786fbf22b3a946ecf8eaae05127fb616d8f12ec94aa9a669e7897a71aee7d9

        SHA512

        e209dfda4a79ba00ad74df6818954a5a2e1db8534344b59c7c16c6e9bd1e53ad24edf3c3cbefcb68cde57a7d26d089bbb1eec047dd09cd634b997ece1704b3e3

      • C:\Windows\uninstal.bat

        Filesize

        218B

        MD5

        49b6d618109390fe8e30baa6877faacf

        SHA1

        fd73166dc7ebd5b53192b1f6fb36f8203d9bef3e

        SHA256

        114d47eaca2d6dd8e00788d99f5de186385bd662d3abc6d60b5caff8071fbfe0

        SHA512

        286018b6f31a5b01d00cd3b2055f4ac32f1aab25d6b7519af4fbc5127390f6a7c5910f95191bd23ae91d364c4c26ca935ef879edab6dfcdadcfdbcab0d23e7fa

      • memory/2156-19-0x00000000033D0000-0x00000000034D0000-memory.dmp

        Filesize

        1024KB

      • memory/2156-21-0x00000000033D0000-0x00000000034D0000-memory.dmp

        Filesize

        1024KB

      • memory/2156-18-0x00000000033D0000-0x00000000034D0000-memory.dmp

        Filesize

        1024KB

      • memory/2156-13-0x00000000033C0000-0x00000000033C1000-memory.dmp

        Filesize

        4KB

      • memory/2156-12-0x0000000003370000-0x0000000003372000-memory.dmp

        Filesize

        8KB

      • memory/2156-11-0x0000000003380000-0x0000000003381000-memory.dmp

        Filesize

        4KB

      • memory/2156-10-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

        Filesize

        4KB

      • memory/2156-9-0x0000000002410000-0x0000000002411000-memory.dmp

        Filesize

        4KB

      • memory/2156-8-0x00000000023E0000-0x00000000023E1000-memory.dmp

        Filesize

        4KB

      • memory/2156-7-0x00000000023F0000-0x00000000023F1000-memory.dmp

        Filesize

        4KB

      • memory/2156-23-0x00000000033D0000-0x00000000034D0000-memory.dmp

        Filesize

        1024KB

      • memory/2156-5-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

        Filesize

        4KB

      • memory/2156-4-0x0000000002400000-0x0000000002401000-memory.dmp

        Filesize

        4KB

      • memory/2156-3-0x00000000023B0000-0x00000000023B1000-memory.dmp

        Filesize

        4KB

      • memory/2156-2-0x00000000023D0000-0x00000000023D1000-memory.dmp

        Filesize

        4KB

      • memory/2156-20-0x00000000033D0000-0x00000000034D0000-memory.dmp

        Filesize

        1024KB

      • memory/2156-17-0x00000000033D0000-0x00000000034D0000-memory.dmp

        Filesize

        1024KB

      • memory/2156-0-0x0000000013140000-0x0000000013240000-memory.dmp

        Filesize

        1024KB

      • memory/2156-6-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

        Filesize

        4KB

      • memory/2156-22-0x00000000033D0000-0x00000000034D0000-memory.dmp

        Filesize

        1024KB

      • memory/2156-24-0x00000000033D0000-0x00000000034D0000-memory.dmp

        Filesize

        1024KB

      • memory/2156-25-0x00000000033D0000-0x00000000034D0000-memory.dmp

        Filesize

        1024KB

      • memory/2156-31-0x0000000003390000-0x0000000003391000-memory.dmp

        Filesize

        4KB

      • memory/2156-30-0x00000000033A0000-0x00000000033A1000-memory.dmp

        Filesize

        4KB

      • memory/2156-29-0x00000000033B0000-0x00000000033B1000-memory.dmp

        Filesize

        4KB

      • memory/2156-28-0x00000000004E0000-0x00000000004E1000-memory.dmp

        Filesize

        4KB

      • memory/2156-27-0x00000000004D0000-0x00000000004D1000-memory.dmp

        Filesize

        4KB

      • memory/2156-26-0x00000000033D0000-0x00000000034D0000-memory.dmp

        Filesize

        1024KB

      • memory/2156-16-0x00000000033D0000-0x00000000034D0000-memory.dmp

        Filesize

        1024KB

      • memory/2156-1-0x0000000000A40000-0x0000000000A94000-memory.dmp

        Filesize

        336KB

      • memory/2156-40-0x0000000013140000-0x0000000013240000-memory.dmp

        Filesize

        1024KB

      • memory/2156-41-0x0000000000A40000-0x0000000000A94000-memory.dmp

        Filesize

        336KB

      • memory/2720-34-0x0000000013140000-0x0000000013240000-memory.dmp

        Filesize

        1024KB

      • memory/2720-44-0x0000000013140000-0x0000000013240000-memory.dmp

        Filesize

        1024KB