Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 11:48

General

  • Target

    631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe

  • Size

    2.7MB

  • MD5

    631c9d33ff3a8d714864fd18e1dbf725

  • SHA1

    d56dbf573cb6082eea1f7b4469e8a5f2be6c75be

  • SHA256

    19e60fcde1b38e7fd6274e33a8defc1658677800d4a85a2c788decc600a36e66

  • SHA512

    86be94c10eecf2c76b5b92dec3bd8ed188c4be0a8b2b3078131ee037185ecb58a37aa99c3df2767800c4c1272f9dc8440613dccae5e5d9e21331a1051e8f9ee3

  • SSDEEP

    49152:RAbx0lVw1ug+yPmu1YNTxNMUWHNIFS3v+4X3PMkMNI/JhM:RAbxL1ug+yuu1Yp7MUWHNHqkwI/A

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 12 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:728
    • C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
        3⤵
        • Drops file in System32 directory
        • Modifies registry class
        PID:2248
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 464
          4⤵
          • Program crash
          PID:1252
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2248 -ip 2248
    1⤵
      PID:2000

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/728-0-0x0000000074E92000-0x0000000074E93000-memory.dmp

      Filesize

      4KB

    • memory/728-1-0x0000000074E90000-0x0000000075441000-memory.dmp

      Filesize

      5.7MB

    • memory/728-2-0x0000000074E90000-0x0000000075441000-memory.dmp

      Filesize

      5.7MB

    • memory/728-9-0x0000000074E90000-0x0000000075441000-memory.dmp

      Filesize

      5.7MB

    • memory/924-3-0x0000000000400000-0x00000000005C5000-memory.dmp

      Filesize

      1.8MB

    • memory/924-6-0x0000000000400000-0x00000000005C5000-memory.dmp

      Filesize

      1.8MB

    • memory/924-13-0x0000000000400000-0x00000000005C5000-memory.dmp

      Filesize

      1.8MB

    • memory/2248-10-0x0000000000400000-0x00000000005CA000-memory.dmp

      Filesize

      1.8MB

    • memory/2248-11-0x0000000000400000-0x00000000005CA000-memory.dmp

      Filesize

      1.8MB

    • memory/2248-14-0x0000000000400000-0x00000000005CA000-memory.dmp

      Filesize

      1.8MB

    • memory/2248-12-0x0000000000400000-0x00000000005CA000-memory.dmp

      Filesize

      1.8MB

    • memory/2248-15-0x0000000000400000-0x00000000005CA000-memory.dmp

      Filesize

      1.8MB