Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2024, 21:22

General

  • Target

    b9316b71bfc22b42ed355d054e5fce96_JaffaCakes118.exe

  • Size

    497KB

  • MD5

    b9316b71bfc22b42ed355d054e5fce96

  • SHA1

    7da2fdfdbcccc7b4affe3f3eb9eb385bd33b0fdb

  • SHA256

    6e37719795dcaa145f5a010a733325c4e522e4b175b82ad62d0e918117775a44

  • SHA512

    900dc8e36dfac0f401744585ab734bf23b4f3154bb55b6340eb2b7e8efb136c1bf5af865ce89fd6fd18b6a5b0b99f6f3b3154fe603e873778142363d01519712

  • SSDEEP

    12288:wQaGtAC2tT/N5Nnt4IrmenbO/DiyAK5xURXjB4vPvLLRQ:DbtF2NF5Nnt4EmeK+pK0RT2HvLNQ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9316b71bfc22b42ed355d054e5fce96_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b9316b71bfc22b42ed355d054e5fce96_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2584
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 696
      2⤵
      • Program crash
      PID:2212
  • C:\Windows\svchost.exe -k
    "C:\Windows\svchost.exe -k"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Program Files\Internet ExploreR\IEXPLORE.EXE
      "C:\Program Files\Internet ExploreR\IEXPLORE.EXE"
      2⤵
        PID:3668
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2584 -ip 2584
      1⤵
        PID:1836

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\svchost.exe -k

        Filesize

        497KB

        MD5

        b9316b71bfc22b42ed355d054e5fce96

        SHA1

        7da2fdfdbcccc7b4affe3f3eb9eb385bd33b0fdb

        SHA256

        6e37719795dcaa145f5a010a733325c4e522e4b175b82ad62d0e918117775a44

        SHA512

        900dc8e36dfac0f401744585ab734bf23b4f3154bb55b6340eb2b7e8efb136c1bf5af865ce89fd6fd18b6a5b0b99f6f3b3154fe603e873778142363d01519712

      • memory/212-6-0x00000000006F0000-0x00000000006F1000-memory.dmp

        Filesize

        4KB

      • memory/212-9-0x0000000000400000-0x0000000000550000-memory.dmp

        Filesize

        1.3MB

      • memory/212-10-0x00000000006F0000-0x00000000006F1000-memory.dmp

        Filesize

        4KB

      • memory/2584-0-0x0000000000400000-0x0000000000550000-memory.dmp

        Filesize

        1.3MB

      • memory/2584-1-0x0000000002500000-0x0000000002501000-memory.dmp

        Filesize

        4KB

      • memory/2584-7-0x0000000000400000-0x0000000000550000-memory.dmp

        Filesize

        1.3MB

      • memory/2584-8-0x0000000002500000-0x0000000002501000-memory.dmp

        Filesize

        4KB