Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/07/2024, 05:17

General

  • Target

    6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe

  • Size

    33KB

  • MD5

    6a5dff1402c457fec4ed0846d3bf3427

  • SHA1

    1a2e0955badb57a335c819308bf4b094ba492ffd

  • SHA256

    c1cd061ed02dd9c82e6fba7423718cb4c71ccae379187e66349ad235d43fc2b1

  • SHA512

    985507fc1578dc4f9864b31c2ea5e9ce627b86dabef690269475f5ecf28b6747d760f4a52d7f7bf4d6c425a2419f7f4b21f74f47ebefe97fdc3058efa50021c7

  • SSDEEP

    768:MvWzqcMcMkrWn+1f1pc/2Id5uVqwXSNjrFmEE3mX7Ue5:MHcM2rWn+ZQcqwiNjrcEEAIe5

Malware Config

Signatures

  • Disables service(s) 3 TTPs
  • Stops running service(s) 4 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 11 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Windows\SysWOW64\net.exe
      net stop cryptsvc
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3496
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop cryptsvc
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3868
    • C:\Windows\SysWOW64\sc.exe
      sc config cryptsvc start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4932
    • C:\Windows\SysWOW64\sc.exe
      sc delete cryptsvc
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4144
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Users\Admin\AppData\Local\Temp\1721798231.dat, ServerMain c:\users\admin\appdata\local\temp\6a5dff1402c457fec4ed0846d3bf3427_jaffacakes118.exe
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1721798231.dat

    Filesize

    33KB

    MD5

    9d4a5bc50b48c654eed239b1b5a5422f

    SHA1

    3272ef5d68e7784590486c1c5994825c4c148193

    SHA256

    5c6bd826eb8cca52e71419740876323d3ddd17f3e4f0b113dbd6da4611a7d125

    SHA512

    aee004b7223f78b5425b4ffd1fd07b64cc923a3f1dbce853da703b7357f79468d70a55922b389dc4234ceddfea3cad250dc2e452d6f76392c4a41f4447c09e04

  • memory/2352-0-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2352-13-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB