Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/07/2024, 08:37

General

  • Target

    5fc85e4419d8733b43b5ae25afb88fbd_JaffaCakes118.exe

  • Size

    70KB

  • MD5

    5fc85e4419d8733b43b5ae25afb88fbd

  • SHA1

    650b8906819e7b96b82a1788b58c5993c6b71c4a

  • SHA256

    6c7c6101a3de28e0abbb30de69473479e28d518d67d122df5c0b64f1325cb637

  • SHA512

    689b3195c7e79cdca6962911b9de3fe60d3e27ad19ba42e852e261d8b0e28e19aef2eb58b5f707ef21a23a1031adbd721f6b271642d0b518ae9710d46d6bc32d

  • SSDEEP

    1536:ACGeHGDJz+grk1IfNvh1NWgywTFZKKydVYHg9S:AjR+o4gFhZKwg

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5fc85e4419d8733b43b5ae25afb88fbd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5fc85e4419d8733b43b5ae25afb88fbd_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3340
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\nathpk.dll",Startup
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1440
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\nathpk.dll",iep
        3⤵
        • Loads dropped DLL
        PID:4420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\nathpk.dll

    Filesize

    70KB

    MD5

    f5224980dd9e1b73abe55009ba2a2ea3

    SHA1

    8d4bb7f08704bfdd7770b9f9701d868e6962194e

    SHA256

    b0a4af04681bdbb45ae4b085be4d4e0c46bbfb2b354012308fd014983df651de

    SHA512

    c6c6e4237caa87707296aca90de17ee9add3bc96ad7018774d96c6444658900ef76313bca653cf5083505c8f221ab607940897168594ae4dea4884318edd88f6

  • memory/1440-11-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB

  • memory/1440-16-0x0000000002B80000-0x0000000002B90000-memory.dmp

    Filesize

    64KB

  • memory/1440-23-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB

  • memory/1440-9-0x0000000002B80000-0x0000000002B90000-memory.dmp

    Filesize

    64KB

  • memory/1440-8-0x0000000002B80000-0x0000000002B90000-memory.dmp

    Filesize

    64KB

  • memory/1440-7-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB

  • memory/1440-19-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB

  • memory/3340-0-0x0000000002320000-0x0000000002330000-memory.dmp

    Filesize

    64KB

  • memory/3340-2-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB

  • memory/3340-15-0x0000000002320000-0x0000000002330000-memory.dmp

    Filesize

    64KB

  • memory/3340-14-0x0000000002320000-0x0000000002330000-memory.dmp

    Filesize

    64KB

  • memory/3340-10-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB

  • memory/3340-1-0x0000000002320000-0x0000000002330000-memory.dmp

    Filesize

    64KB

  • memory/4420-21-0x0000000002F90000-0x0000000002FA0000-memory.dmp

    Filesize

    64KB

  • memory/4420-20-0x0000000002F90000-0x0000000002FA0000-memory.dmp

    Filesize

    64KB

  • memory/4420-24-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB

  • memory/4420-28-0x0000000002F90000-0x0000000002FA0000-memory.dmp

    Filesize

    64KB

  • memory/4420-27-0x0000000002F90000-0x0000000002FA0000-memory.dmp

    Filesize

    64KB