Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 02:06

General

  • Target

    3fc6475437b00a1a3c92ae727606a189_JaffaCakes118.exe

  • Size

    4.4MB

  • MD5

    3fc6475437b00a1a3c92ae727606a189

  • SHA1

    3caf43344baeb96c8894cfdae7ab03fd621208ef

  • SHA256

    3efe415db3fbcb5dea8d90c05744c7473c5527f3cdd2ab73d4d82ba5c5392065

  • SHA512

    c1c442725441cac58e365bb39c3bc8ee3e218619a1e4ba75959c3dcc77ddd902847f3fa011e07c892c5b20c9ab89aa5ed9bfadf0e2940ecffe0f2ab8b4cf7530

  • SSDEEP

    49152:AYUjy3BoB/VrbnrFF3UyDAWifKcykcf/aup1YrUH7TOJV/rcE0Z7ve4D94IX2EkH:AYUwOZFF3BpifLCCupqS6zcEG7W4aivo

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3fc6475437b00a1a3c92ae727606a189_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3fc6475437b00a1a3c92ae727606a189_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:5056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\{BCC6538D-455D-4A8E-8D2E-8DA29FF2152D}.dll

    Filesize

    120KB

    MD5

    c9f333d1ff898672a34805f94a265329

    SHA1

    2deaac66698fb2e9b3868d23034c3211c508b739

    SHA256

    07e546811635574c77edfda126b0e5f5292b4ea13f35158eddedcfc3cbf74b6b

    SHA512

    048c71e48e2def0bfc69ebfb69b834d650a9377082782333f50728fdfd6675df8093d0c87e606022e55d09f81549d4ca3b640bcdd33b9ddc9aace03ee1466add

  • C:\Users\Admin\AppData\Local\Temp\~zm_{73B59267-F907-400F-ACA0-66C719EA76A0}\images\bg.png

    Filesize

    86KB

    MD5

    7ffd06e91886833dca81eafbfe8550e0

    SHA1

    f3645a513e284264b5690799e79de735d2a3a260

    SHA256

    06120105a7eb2ad1c563d91f9e757b5982c2975c3bb199f28a6d56c4e8ad1589

    SHA512

    a9c715e50047eae52c874634ff4c65d954eaa18d568d8a27e315e8d603a9a49d326458010dc62027f012fa72b4e6ddfd489b256ca5a3174d6589fd89e324774f

  • C:\Users\Admin\AppData\Local\Temp\~zm_{73B59267-F907-400F-ACA0-66C719EA76A0}\lic.html

    Filesize

    5KB

    MD5

    2fd0ada3d50512cfec89a8b4a9563674

    SHA1

    d0612b9a0c99bd04cbc50ca1fd2dfeb076b0666f

    SHA256

    d7db70403cb2bc7b17e6718c43caf4a416358a6a9b3e30616a92d87c2a392ee5

    SHA512

    2ede17ae33698dec16637c75069b1f9b6d783d608dc9b2e073b691acc1f9ed6355664111d003af3f53afe2604a257835df646225f8c44342c50d9bb14f75b0ae

  • C:\Users\Admin\AppData\Local\Temp\~zm_{73B59267-F907-400F-ACA0-66C719EA76A0}\page.html

    Filesize

    1KB

    MD5

    d53bf699680d85037f8f858a82e0329e

    SHA1

    41710cd210b132694fa940442e81ebc70e1398fe

    SHA256

    c690ac05301658a1c666b62f4f5d5d4030773d986c2e44179bdfa328dac1d655

    SHA512

    2ebb62ca51ca89ca4be923f787699693402eb3fbe853b21e049b5729108953131583de92a91c75372efb467b3bd554ba1909526417427b1cc0d31c8bfad7143f

  • memory/5056-3-0x0000000000400000-0x000000000072A000-memory.dmp

    Filesize

    3.2MB

  • memory/5056-13-0x0000000005170000-0x00000000051CB000-memory.dmp

    Filesize

    364KB

  • memory/5056-12-0x0000000005170000-0x00000000051CB000-memory.dmp

    Filesize

    364KB

  • memory/5056-0-0x0000000000407000-0x000000000040A000-memory.dmp

    Filesize

    12KB

  • memory/5056-2-0x0000000000400000-0x000000000072A000-memory.dmp

    Filesize

    3.2MB

  • memory/5056-1-0x0000000000400000-0x000000000072A000-memory.dmp

    Filesize

    3.2MB

  • memory/5056-116-0x0000000000400000-0x000000000072A000-memory.dmp

    Filesize

    3.2MB

  • memory/5056-117-0x0000000000407000-0x000000000040A000-memory.dmp

    Filesize

    12KB

  • memory/5056-119-0x0000000005170000-0x00000000051CB000-memory.dmp

    Filesize

    364KB