Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2024, 05:08

General

  • Target

    446de64024dd7c4bea6f65cf695c52c0_JaffaCakes118.exe

  • Size

    50KB

  • MD5

    446de64024dd7c4bea6f65cf695c52c0

  • SHA1

    430510018735a32ea08dfb624f79f1faae0b410b

  • SHA256

    401ca9cb0edb177fd7b358c665ccf39d5aac88031ef08487149341671fe9661a

  • SHA512

    e6445d966176c00e8510339cc1e5378c96665fbfee1408ce5b0a76f31f01d359cef171ed9e8778bb54f8e91612f72eb3a829d80a86f41e2ae8193d24b34985dd

  • SSDEEP

    768:iiz8iL8RHgY1J2HXDvftMvOnm9MMPPXffaTRj3eHUeAj3I/zXGAUaU3Qvjc:i89nYv2HXztM2nm9tf038UeAj4XGBE4

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:616
    • C:\Users\Admin\AppData\Local\Temp\446de64024dd7c4bea6f65cf695c52c0_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\446de64024dd7c4bea6f65cf695c52c0_JaffaCakes118.exe"
      1⤵
      • Modifies WinLogon for persistence
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2192

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/616-39-0x0000000004C90000-0x0000000004CB6000-memory.dmp

      Filesize

      152KB

    • memory/616-53-0x0000000004D20000-0x0000000004D46000-memory.dmp

      Filesize

      152KB

    • memory/616-78-0x0000000004E10000-0x0000000004E36000-memory.dmp

      Filesize

      152KB

    • memory/616-74-0x0000000004DE0000-0x0000000004E06000-memory.dmp

      Filesize

      152KB

    • memory/616-10-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

    • memory/616-15-0x0000000004BA0000-0x0000000004BC6000-memory.dmp

      Filesize

      152KB

    • memory/616-18-0x0000000004BD0000-0x0000000004BF6000-memory.dmp

      Filesize

      152KB

    • memory/616-25-0x0000000004C00000-0x0000000004C26000-memory.dmp

      Filesize

      152KB

    • memory/616-33-0x0000000004C60000-0x0000000004C86000-memory.dmp

      Filesize

      152KB

    • memory/616-70-0x0000000004DB0000-0x0000000004DD6000-memory.dmp

      Filesize

      152KB

    • memory/616-48-0x0000000004CF0000-0x0000000004D16000-memory.dmp

      Filesize

      152KB

    • memory/616-44-0x0000000004CC0000-0x0000000004CE6000-memory.dmp

      Filesize

      152KB

    • memory/616-64-0x0000000004D80000-0x0000000004DA6000-memory.dmp

      Filesize

      152KB

    • memory/616-29-0x0000000004C30000-0x0000000004C56000-memory.dmp

      Filesize

      152KB

    • memory/616-58-0x0000000004D50000-0x0000000004D76000-memory.dmp

      Filesize

      152KB

    • memory/2192-0-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

    • memory/2192-1-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

    • memory/2192-2-0x0000000000410000-0x0000000000412000-memory.dmp

      Filesize

      8KB

    • memory/2192-3-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

    • memory/2192-3750-0x0000000000410000-0x0000000000412000-memory.dmp

      Filesize

      8KB