Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 01:21

General

  • Target

    a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe

  • Size

    748KB

  • MD5

    a4d5eeb07bb81d0c99911a57a02d058b

  • SHA1

    904574e54f910793a3fe9f912d0911293350e4f4

  • SHA256

    92d1c63c4d8eb86dcb20961260b3cc92cafa4fd22889ba04ce63d7467abc67b7

  • SHA512

    1782cfcf668ebce1d71705d4f4da79a17ae1ad703850803ae3aab41f2002f5bfa3dbb4d951c55f7f4526b03e2db62db0e9d9553a46f820a25406b7ba09ac4df3

  • SSDEEP

    12288:NYLIHAa68vN/+nc6FwDqCpi96x58P1lAXGNrspt95Ehay8urkPz0TuTcj06K6:hgaJv5+ckw3pia5svT8uG0TuQjpR

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4488
    • C:\Users\Admin\AppData\Local\Temp\a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:224
      • C:\Recycle.Bin\B6232F3A9D9.exe
        "C:\Recycle.Bin\B6232F3A9D9.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3920
        • C:\Recycle.Bin\B6232F3A9D9.exe
          "C:\Recycle.Bin\B6232F3A9D9.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3952
          • C:\Users\Admin\AppData\Local\Temp\8O3B99B.exe
            "C:\Users\Admin\AppData\Local\Temp\8O3B99B.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer Phishing Filter
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Recycle.Bin\B6232F3A9D9.exe

    Filesize

    748KB

    MD5

    a4d5eeb07bb81d0c99911a57a02d058b

    SHA1

    904574e54f910793a3fe9f912d0911293350e4f4

    SHA256

    92d1c63c4d8eb86dcb20961260b3cc92cafa4fd22889ba04ce63d7467abc67b7

    SHA512

    1782cfcf668ebce1d71705d4f4da79a17ae1ad703850803ae3aab41f2002f5bfa3dbb4d951c55f7f4526b03e2db62db0e9d9553a46f820a25406b7ba09ac4df3

  • C:\Recycle.Bin\E7C6BB99244FE89

    Filesize

    492KB

    MD5

    383ebf8a32a4a4679ea335c546d71f9f

    SHA1

    12e5c95df63f2cc00df20e5c0fe8dc5c39343263

    SHA256

    b7b1103b82e47f8c39ab5e8f56150de37b06d579944c6c051c2b569be992aa00

    SHA512

    a291ab3d4cf2b5bf4ec03d345a4b2656a46f67ba4e4ffdbee37085b105162491dbf1e736eae1dea204398229decd5f8c853c82a04a4426c960511863aa7fa77a

  • C:\Users\Admin\AppData\Local\Temp\8O3B99B.exe

    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • memory/224-8-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/224-13-0x0000000000530000-0x0000000000531000-memory.dmp

    Filesize

    4KB

  • memory/224-11-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/224-12-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/224-10-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/224-4-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/224-7-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/224-9-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/224-14-0x0000000000530000-0x0000000000531000-memory.dmp

    Filesize

    4KB

  • memory/224-18-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/224-5-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/224-74-0x00000000774C2000-0x00000000774C4000-memory.dmp

    Filesize

    8KB

  • memory/224-2-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/224-75-0x0000000000540000-0x0000000000541000-memory.dmp

    Filesize

    4KB

  • memory/224-6-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/804-97-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-85-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-131-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-47-0x0000000000850000-0x000000000089E000-memory.dmp

    Filesize

    312KB

  • memory/804-127-0x0000000000850000-0x000000000089E000-memory.dmp

    Filesize

    312KB

  • memory/804-56-0x0000000001001000-0x0000000001002000-memory.dmp

    Filesize

    4KB

  • memory/804-55-0x0000000000F70000-0x0000000000FC4000-memory.dmp

    Filesize

    336KB

  • memory/804-59-0x0000000000850000-0x000000000089E000-memory.dmp

    Filesize

    312KB

  • memory/804-69-0x0000000001000000-0x0000000001004000-memory.dmp

    Filesize

    16KB

  • memory/804-71-0x0000000002B50000-0x0000000002B9C000-memory.dmp

    Filesize

    304KB

  • memory/804-128-0x00000000005D0000-0x00000000005D5000-memory.dmp

    Filesize

    20KB

  • memory/804-99-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-111-0x0000000075130000-0x0000000075132000-memory.dmp

    Filesize

    8KB

  • memory/804-110-0x00000000774C4000-0x00000000774C6000-memory.dmp

    Filesize

    8KB

  • memory/804-120-0x0000000074E20000-0x0000000075270000-memory.dmp

    Filesize

    4.3MB

  • memory/804-109-0x00000000774C2000-0x00000000774C4000-memory.dmp

    Filesize

    8KB

  • memory/804-108-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-98-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-129-0x00000000005E0000-0x00000000005E6000-memory.dmp

    Filesize

    24KB

  • memory/804-96-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-95-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-94-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-92-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-91-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-90-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-89-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-88-0x0000000002B50000-0x0000000002B9C000-memory.dmp

    Filesize

    304KB

  • memory/804-87-0x0000000002B50000-0x0000000002B9C000-memory.dmp

    Filesize

    304KB

  • memory/804-86-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-38-0x0000000000850000-0x000000000089E000-memory.dmp

    Filesize

    312KB

  • memory/804-84-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-83-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-82-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-81-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-80-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-79-0x0000000000F70000-0x0000000000FC4000-memory.dmp

    Filesize

    336KB

  • memory/804-78-0x0000000000F70000-0x0000000000FC4000-memory.dmp

    Filesize

    336KB

  • memory/804-130-0x0000000000F70000-0x0000000000FC4000-memory.dmp

    Filesize

    336KB

  • memory/804-68-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/804-64-0x00000000005E0000-0x00000000005E6000-memory.dmp

    Filesize

    24KB

  • memory/804-63-0x0000000000850000-0x000000000089E000-memory.dmp

    Filesize

    312KB

  • memory/804-62-0x0000000000850000-0x000000000089E000-memory.dmp

    Filesize

    312KB

  • memory/804-61-0x0000000000F70000-0x0000000000FC4000-memory.dmp

    Filesize

    336KB

  • memory/804-60-0x0000000000850000-0x000000000089E000-memory.dmp

    Filesize

    312KB

  • memory/804-54-0x00000000005E0000-0x00000000005E6000-memory.dmp

    Filesize

    24KB

  • memory/804-53-0x00000000005D0000-0x00000000005D5000-memory.dmp

    Filesize

    20KB

  • memory/804-52-0x0000000000850000-0x000000000089E000-memory.dmp

    Filesize

    312KB

  • memory/804-45-0x0000000000850000-0x000000000089E000-memory.dmp

    Filesize

    312KB

  • memory/804-46-0x0000000000850000-0x000000000089E000-memory.dmp

    Filesize

    312KB

  • memory/804-124-0x0000000074E20000-0x0000000075270000-memory.dmp

    Filesize

    4.3MB

  • memory/804-125-0x0000000074E20000-0x0000000075270000-memory.dmp

    Filesize

    4.3MB

  • memory/804-126-0x0000000074E20000-0x0000000075270000-memory.dmp

    Filesize

    4.3MB

  • memory/3952-29-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3952-28-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3952-32-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3952-33-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB

  • memory/3952-40-0x0000000000400000-0x00000000004DA000-memory.dmp

    Filesize

    872KB