Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 14:56

General

  • Target

    5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe

  • Size

    88KB

  • MD5

    5c6cc61b12bc997b3ad44dc3e7e48869

  • SHA1

    fc7a56e3a007f9d2bc6e66a799d37568531e4df9

  • SHA256

    7e1e5846a07f31e9686f153ee178fab64d935fbdeb3fdffb0fca1204a6fbdb11

  • SHA512

    26d22c3372cc071d92c19f4cec31c0ebda8f761b71639271b8d4b3cc54de1d0a5f454f03ef946b07a21e818d956584622930c21dfba2cff85f6732d16f7b792a

  • SSDEEP

    1536:XtZHJGPKZi+unw3uzV1cnf+7YT3CiippoNr9hTcOujjwGTr0aIiksSaV1K7ZN+:d3GCZi+u93427uCuNr9hoOVGToadTutQ

Score
8/10

Malware Config

Signatures

  • Server Software Component: Terminal Services DLL 1 TTPs 14 IoCs
  • Loads dropped DLL 36 IoCs
  • Drops file in System32 directory 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe"
    1⤵
    • Server Software Component: Terminal Services DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:3632
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
    1⤵
    • Loads dropped DLL
    PID:3544
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
    1⤵
    • Loads dropped DLL
    PID:1144
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
    1⤵
    • Loads dropped DLL
    PID:3048
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
    1⤵
    • Loads dropped DLL
    PID:1512
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
    1⤵
    • Loads dropped DLL
    PID:3224
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
    1⤵
    • Loads dropped DLL
    PID:684
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
    1⤵
    • Loads dropped DLL
    PID:2920
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
    1⤵
    • Loads dropped DLL
    PID:4112
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
    1⤵
    • Loads dropped DLL
    PID:4600
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
    1⤵
    • Loads dropped DLL
    PID:640
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
    1⤵
    • Loads dropped DLL
    PID:1244
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
    1⤵
    • Loads dropped DLL
    PID:2148

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

    Filesize

    88KB

    MD5

    9c014d1c54457c16c99782df12610b85

    SHA1

    6bac6ad9d8f375ccca6cb349e88dcdd90f16e13d

    SHA256

    6b51809245383365496c333e3dddda94887d66fe39f7510fe8f40c56c96dd82a

    SHA512

    4115e2ea25356e0a23de2a9382ca7bcce2696108eca4d32c52a8bd52f0ce0ab9693c6a05c2916414c546ea5b89bf090da78f48fe41be5531e3897f3dfe9c87a3

  • memory/640-69-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/640-67-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/640-68-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/1144-13-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/1144-16-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/1144-17-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/1512-30-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/1512-50-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/2148-83-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/2148-81-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/2148-82-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/2920-49-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/3048-21-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/3224-35-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/3224-37-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/3544-7-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/3544-9-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/3544-8-0x0000000074F50000-0x0000000074F72000-memory.dmp

    Filesize

    136KB

  • memory/3632-0-0x0000000000F50000-0x0000000000F72000-memory.dmp

    Filesize

    136KB

  • memory/3632-24-0x0000000000F50000-0x0000000000F72000-memory.dmp

    Filesize

    136KB