Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 05:42

General

  • Target

    eab1181d644b1fc91512497219929233_JaffaCakes118.exe

  • Size

    80KB

  • MD5

    eab1181d644b1fc91512497219929233

  • SHA1

    9815b16409886c2faaa833728a1b7a5a9605e8e3

  • SHA256

    a4c22404f0aaf35832ff67b13a45b42e023c8aa02d0d240a9dca0d6464a7a35d

  • SHA512

    659354852d0acfd4d2f97179be5ab2523b1d1bd179cbbd1c8a8c70e5cd57269847b99683b2726470ac0484e55ba5c099db56c464bac9de0d76676cc8fa827e60

  • SSDEEP

    1536:9uC1dl50pS1HQg1YBWo04NUqkojFWHw5pe9Riz5MLXIbyO:9dL1H2jgkpemz5m4bT

Malware Config

Signatures

  • Blocklisted process makes network request 5 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eab1181d644b1fc91512497219929233_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eab1181d644b1fc91512497219929233_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4624
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\\e9bfafce-1854-45e4-afd9-3a52da20b975\wrkBA95.tmp_46", start first worker
      2⤵
      • Blocklisted process makes network request
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\\e9bfafce-1854-45e4-afd9-3a52da20b975\wrkC3FC.tmp_46", start task worker
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\e9bfafce-1854-45e4-afd9-3a52da20b975\wrkBA95.tmp_46

    Filesize

    80KB

    MD5

    fa093219878c389ca88b89b67f93236b

    SHA1

    b8ba51896287b8912346acf3ebf7e28d837c8d80

    SHA256

    a7f80596128abd24953c249a7673278d52abb0e67c241ab1c16c17be85b64fcc

    SHA512

    2e650674f724068ce4822e709d7d7874a0d92083e96e63e7c5cf4608e2ad4b0f5fa373fc6f3971fd43cffa03ea0eadd7dc8714f90595885e9ee90c29f15bab3e

  • memory/1952-22-0x0000000073F80000-0x0000000073FA7000-memory.dmp

    Filesize

    156KB

  • memory/1952-33-0x0000000010000000-0x000000001000C000-memory.dmp

    Filesize

    48KB

  • memory/1952-29-0x0000000073F80000-0x0000000073FA7000-memory.dmp

    Filesize

    156KB

  • memory/1952-27-0x0000000010000000-0x000000001000C000-memory.dmp

    Filesize

    48KB

  • memory/2844-11-0x0000000010000000-0x000000001000C000-memory.dmp

    Filesize

    48KB

  • memory/2844-18-0x0000000010000000-0x000000001000C000-memory.dmp

    Filesize

    48KB

  • memory/2844-10-0x0000000075490000-0x00000000754B7000-memory.dmp

    Filesize

    156KB

  • memory/2844-28-0x0000000075490000-0x00000000754B7000-memory.dmp

    Filesize

    156KB

  • memory/2844-32-0x0000000010000000-0x000000001000C000-memory.dmp

    Filesize

    48KB

  • memory/4624-0-0x0000000000DD0000-0x0000000000DF7000-memory.dmp

    Filesize

    156KB

  • memory/4624-7-0x0000000000DD0000-0x0000000000DF7000-memory.dmp

    Filesize

    156KB

  • memory/4624-2-0x0000000010000000-0x000000001000C000-memory.dmp

    Filesize

    48KB

  • memory/4624-1-0x00000000027E0000-0x00000000027E1000-memory.dmp

    Filesize

    4KB