Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 15:10

General

  • Target

    e2d061cb1b9a5e0ce3b2b4643b74d8df_JaffaCakes118.exe

  • Size

    172KB

  • MD5

    e2d061cb1b9a5e0ce3b2b4643b74d8df

  • SHA1

    a18888d0b2685e5d2033e1ae62cbb3798287c4ef

  • SHA256

    18c6613792002a37e9ec93b449cb77b5d50c8d12e5fe3075b90d9a1660db2a66

  • SHA512

    8b339f01eed8b37b0a50bd74e4a87ad6d04c7fbe109bdab7ab4a47d0b54b794aa186887cc9b7011ebc6c293ac0312c26ebd2ac96858f579aced67c34c29b9943

  • SSDEEP

    3072:dr7ZB1IEZB44rJYtHfTyzcfMZcCUfkaNKk45q8M9t:17ZXv442HfTRYk4Q

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2d061cb1b9a5e0ce3b2b4643b74d8df_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e2d061cb1b9a5e0ce3b2b4643b74d8df_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\roodiax.exe
      "C:\Users\Admin\roodiax.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1608
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3952

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\roodiax.exe

      Filesize

      172KB

      MD5

      d791256adb303441b10adbbf88227615

      SHA1

      c1c0ac3d57c98bc731d0a10426052b25750ae416

      SHA256

      18d6dd5c5c54018a60b033314c0c15a316dce942ded5ccaa5d1315bd885ef40a

      SHA512

      7667936b0973c95c22993efaba3e6c0afdd02f6c89f68823e6f60a66b29d200503b7cde7c67257d2d4182c549183432786a10278758c0e79fd8e087373e2162d