Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 18:15

General

  • Target

    e58dd8f61151a54bfa678ddf428009e4_JaffaCakes118.exe

  • Size

    7.9MB

  • MD5

    e58dd8f61151a54bfa678ddf428009e4

  • SHA1

    52602ce35b7baf50a55ec1ece9a50733973afc01

  • SHA256

    5a219dd672a2893e8d89222da783e1c83780fb6fd2daca5355439505aeb5682f

  • SHA512

    6bb579a71196f1f8a2e55e87f0c7c4a1df1c482a2764ac3df6e685218f6bf85215abbb47126bcba1f0f8ce4ee389c4ee63ceb40754c73241bfabf2155bb328c7

  • SSDEEP

    196608:0dazg7DS8dazg7DS8dazg7DS8dazg7DSv:Rg7uJg7uJg7uJg7uv

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e58dd8f61151a54bfa678ddf428009e4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e58dd8f61151a54bfa678ddf428009e4_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3868
    • C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe" /f
      2⤵
      • Adds Run key to start application
      • Modifies registry key
      PID:3148
    • C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
      "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
        "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1912
    • C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe
      "C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe

    Filesize

    7.9MB

    MD5

    67ba15765961f63e9680f1091c4ff4f8

    SHA1

    d23919bf234df46321b223ef23bd83ff4611ae33

    SHA256

    ea6755c8eacd66560925d75a9af65c9bfff5c1204fc18366cff06887eba10fa4

    SHA512

    ef44aaf89fb3ea304d54d026d4821d101d3d8431bffc3a0915aa7cbd28d45ad2580ea806961824bc20c0dcb4382757a59e207a5c9f64b61ce8ccd116d8e0d857

  • C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe

    Filesize

    1.0MB

    MD5

    a2f259ceb892d3b0d1d121997c8927e3

    SHA1

    6e0a7239822b8d365d690a314f231286355f6cc6

    SHA256

    ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420

    SHA512

    5ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad

  • memory/1716-34-0x0000000000400000-0x0000000000601000-memory.dmp

    Filesize

    2.0MB

  • memory/1716-29-0x0000000000400000-0x0000000000601000-memory.dmp

    Filesize

    2.0MB

  • memory/1716-12-0x0000000002200000-0x0000000002201000-memory.dmp

    Filesize

    4KB

  • memory/1912-37-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/1912-33-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/1912-44-0x0000000002100000-0x0000000002101000-memory.dmp

    Filesize

    4KB

  • memory/1912-41-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/1912-39-0x0000000002100000-0x0000000002101000-memory.dmp

    Filesize

    4KB

  • memory/1912-35-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/1912-31-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/3868-11-0x0000000000400000-0x0000000000601000-memory.dmp

    Filesize

    2.0MB

  • memory/3868-1-0x0000000000400000-0x0000000000601000-memory.dmp

    Filesize

    2.0MB

  • memory/3868-0-0x0000000000900000-0x0000000000901000-memory.dmp

    Filesize

    4KB

  • memory/3868-24-0x0000000000400000-0x0000000000601000-memory.dmp

    Filesize

    2.0MB

  • memory/4632-30-0x0000000000400000-0x00000000004FB000-memory.dmp

    Filesize

    1004KB

  • memory/4632-38-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/4632-28-0x00000000022D0000-0x00000000022D1000-memory.dmp

    Filesize

    4KB

  • memory/4632-25-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB