Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 03:59

General

  • Target

    a54d4bcc9ed6a273232ecb2a47b52b83_JaffaCakes118.exe

  • Size

    16KB

  • MD5

    a54d4bcc9ed6a273232ecb2a47b52b83

  • SHA1

    472bd599be7a1dfd9aaa88d9d7dd505de93aba7e

  • SHA256

    bf288daf49b02624436ad5550bf6a3df8e3dd750adc0a209abfdd35f42245306

  • SHA512

    d77e0899483b8d83d1db84ebcff3b01acccc96ad56943264818e11e3b213ccbed7f0a905292eda3494f8b35942e53647f2c65c593764c469b899d21e337d0f5f

  • SSDEEP

    384:TcyvESwjENqCVCDvp15zcrvJFn5tsqwO6aNHx/4hh:AyvhwjENyDP5Qjvn5TwO6aV

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3420
      • C:\Users\Admin\AppData\Local\Temp\a54d4bcc9ed6a273232ecb2a47b52b83_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\a54d4bcc9ed6a273232ecb2a47b52b83_JaffaCakes118.exe"
        2⤵
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Windows\system32\ald.bat
          3⤵
          • System Location Discovery: System Language Discovery
          PID:608

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\~75.tmp

      Filesize

      10KB

      MD5

      1b041b89de8730ce73a81ca00bd4396f

      SHA1

      7a987eec8d58bb26d30ab48b3a81c78f89410cdc

      SHA256

      5b9109d0adf77e886f40f3f28ab12caa4253ec2ad79b886eaca45a88fee98225

      SHA512

      247e6614f1c81ae11e111fe6b8f6f3acb415253bb5a4e13cf9700effc020a32c7d4148eb86cc77cf492175427edc12d20e1ec919e5134fd777fe7d7085d6a940

    • C:\Windows\SysWOW64\ald.bat

      Filesize

      212B

      MD5

      05fd3e0fd35248eda6a0c9a3b3c005ea

      SHA1

      35af83fff90dd7702e347b679491a0bc23ad676b

      SHA256

      20bf8aa2060269b51fb5e6e114ceeba93176c1e4b4a5b3c471efa6f9e95640a3

      SHA512

      2992324c745c13b6b8fbc7048eae22ff9461bebed0adcc366e1556d64ebf84ce9ea3e8826bbad39faa4dee61678c5837e49bd8b311515803842915d7a0b206d4

    • memory/2584-0-0x0000000013140000-0x000000001315B000-memory.dmp

      Filesize

      108KB

    • memory/2584-15-0x0000000013140000-0x000000001315B000-memory.dmp

      Filesize

      108KB