Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    3s
  • max time network
    6s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2024, 04:12

Errors

Reason
Machine shutdown

General

  • Target

    3bf21f030c56758db27520bcccfec895_JaffaCakes118.exe

  • Size

    92KB

  • MD5

    3bf21f030c56758db27520bcccfec895

  • SHA1

    88e9a04685acc24fd8e16e5ea2d12782366da15b

  • SHA256

    c907c7b07b1ad7b05226e3e2ea51be88c3d92249ded58ca62502efc652611d77

  • SHA512

    fa30a7040164386afe77c96b2e3e431df920091d46885a0e8f422df00e8f6594272e2387015acfa63771e150ab01afe10088ba11d956b9a31a032683c1d93ec1

  • SSDEEP

    1536:Y4prKHq7RWDwj4XcN7Sr3QboUImD1qoVlrQnGCuhUk1sTLzMo:Y4NKHYZkr3QboUIABscSKsPzMo

Malware Config

Signatures

  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Drops file in System32 directory 1 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3bf21f030c56758db27520bcccfec895_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3bf21f030c56758db27520bcccfec895_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1020
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa3994055 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1020-0-0x0000000001000000-0x0000000001018000-memory.dmp

    Filesize

    96KB

  • memory/1020-2-0x0000000001000000-0x0000000001018000-memory.dmp

    Filesize

    96KB

  • memory/1020-1-0x0000000001001000-0x0000000001002000-memory.dmp

    Filesize

    4KB

  • memory/1020-3-0x0000000001000000-0x0000000001018000-memory.dmp

    Filesize

    96KB