Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 10:43

General

  • Target

    4970cc4a5ca67fcc055b968376296828_JaffaCakes118.exe

  • Size

    347KB

  • MD5

    4970cc4a5ca67fcc055b968376296828

  • SHA1

    ec370477421a5b99468cab0facb6ba293a2429d7

  • SHA256

    0d656ed42a443817e8cf10e04c5fbdf86674555828e159576c796df42d3ebdc3

  • SHA512

    c5800b1e88db4e7dd8522bb2ac801343d9d6451ef3afb6bc7d1489773e752c7138829cc6d53b735850b061dec42365e77c1ca3eb3898472211ac2d0c1bcc22bc

  • SSDEEP

    6144:GulRMmhAReljb2QE5sKfBse2T2DVUgeNtzvE6g1VHeqgImGtUldVf360:GERMujEvBsfb3IeXZtlHK0

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4970cc4a5ca67fcc055b968376296828_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4970cc4a5ca67fcc055b968376296828_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:412
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
      2⤵
        PID:3668
    • C:\Windows\bookly
      C:\Windows\bookly
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3884
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        2⤵
          PID:1900

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\bookly

        Filesize

        347KB

        MD5

        4970cc4a5ca67fcc055b968376296828

        SHA1

        ec370477421a5b99468cab0facb6ba293a2429d7

        SHA256

        0d656ed42a443817e8cf10e04c5fbdf86674555828e159576c796df42d3ebdc3

        SHA512

        c5800b1e88db4e7dd8522bb2ac801343d9d6451ef3afb6bc7d1489773e752c7138829cc6d53b735850b061dec42365e77c1ca3eb3898472211ac2d0c1bcc22bc

      • C:\Windows\uninstal.bat

        Filesize

        218B

        MD5

        db65bab731c7102a317ece0c88b4fe8d

        SHA1

        88483058ff191ce2f02935f356d4b7da1cf0a57f

        SHA256

        f42d7d5d8fc881ad9729dfed8a94876cc9837da70f44bdefa6b2b3fcba53356e

        SHA512

        b7f9f575b065fa7e4ae16e946db9cb88669970bb71b97c81afbd9f9cb53b23246381cdcdc73c5ac203ff701938c79a24f2287b46f88b983a2486e34f458bef31

      • memory/412-6-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/412-2-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/412-5-0x000000000055A000-0x00000000005A8000-memory.dmp

        Filesize

        312KB

      • memory/412-8-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/412-9-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/412-7-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/412-0-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/412-12-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/412-4-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/412-1-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/3884-19-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/3884-24-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/3884-22-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/3884-21-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/3884-20-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/3884-23-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB

      • memory/3884-29-0x0000000000400000-0x00000000005B2000-memory.dmp

        Filesize

        1.7MB