Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 01:29

General

  • Target

    47a6ec15d7e3337eadaa52437ffb76ab_JaffaCakes118.exe

  • Size

    337KB

  • MD5

    47a6ec15d7e3337eadaa52437ffb76ab

  • SHA1

    7da971a938b45c6cbdd9a5d1fd3dee2c386a776e

  • SHA256

    84d31ec06b4109e319696da3659a2e471310677956d6e7d4b7fe6315ca3a4453

  • SHA512

    1d4795f3545015fc707456e0b77831df8182b7d2841b13676a27b65bff478ffdd0ca13390cc834df6c9c78612e67e8830c35880e79575b909cc82415f71efa15

  • SSDEEP

    6144:Djk1EHI7OyXfOe5JnVZFrv7p4TKcw5TCSRL/5eQ9PrtLE9aV4U:DjGjPOevnllBcCrPr1EMWU

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\47a6ec15d7e3337eadaa52437ffb76ab_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\47a6ec15d7e3337eadaa52437ffb76ab_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4488
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\s.cmd
      2⤵
        PID:4552

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\s.cmd

      Filesize

      249B

      MD5

      cb31818fa27e67bdc6f4b35f52413d75

      SHA1

      1dd40ce52d4945fe5e45cb5eef42ca73978da789

      SHA256

      e97ff7549fd412b1fdec7b56cbfd8879d026d604ef51c6bae990f853c9b0997c

      SHA512

      942f4f9e41726f6ab7f3f7013f7ae0505f8a1d4ba81b5936cb44de89536e210054282bb46760e247c8d506fb4a168a989773d26ac0c5f077c09a6dbb7aeade6b

    • memory/4488-0-0x0000000000400000-0x0000000000493000-memory.dmp

      Filesize

      588KB

    • memory/4488-12-0x0000000000400000-0x0000000000493000-memory.dmp

      Filesize

      588KB