Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    109s
  • max time network
    111s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2024, 12:54

General

  • Target

    3932bfc7da25869a56bb6b403d965394_JaffaCakes118.exe

  • Size

    397KB

  • MD5

    3932bfc7da25869a56bb6b403d965394

  • SHA1

    2db6a0a4bc93015ff4b796e953ae546ed8dc1e26

  • SHA256

    08567099c980b6b7e9370ea51eb5567a85bf0d5bd1a97eeb4167fdaafe6c9f2e

  • SHA512

    0766f0423257fa5b6244720578a947f21eb50d92c995de161150d4d5fb4032a3b82c129460f470e26199417e52c39804d39d199e640acd46691bb04401efcb41

  • SSDEEP

    3072:4eFXs/QHelmNHaduN2czYt4YiYdAx+9C+Op4Xvce00DBt88bKy3eFXs/QHelmNnc:XX+zmNHadn4yJ/cRX+zmNnadn4yJ/c

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3932bfc7da25869a56bb6b403d965394_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3932bfc7da25869a56bb6b403d965394_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 812
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1084-0-0x00007FFBB36D5000-0x00007FFBB36D6000-memory.dmp

    Filesize

    4KB

  • memory/1084-1-0x00007FFBB3420000-0x00007FFBB3DC1000-memory.dmp

    Filesize

    9.6MB

  • memory/1084-2-0x000000001B440000-0x000000001B4E6000-memory.dmp

    Filesize

    664KB

  • memory/1084-3-0x00007FFBB3420000-0x00007FFBB3DC1000-memory.dmp

    Filesize

    9.6MB

  • memory/1084-10-0x00007FFBB3420000-0x00007FFBB3DC1000-memory.dmp

    Filesize

    9.6MB