Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09/04/2024, 10:45
General
-
Target
e9cfe0e39c91f99fe5011e49716df789_JaffaCakes118.exe
-
Size
4.2MB
-
MD5
e9cfe0e39c91f99fe5011e49716df789
-
SHA1
e9b9d38265c49684718e1d361f26b31456e8d9f0
-
SHA256
c933007cb54c2a9cf5288f4efe70af4352baa3844f7dc4a6df8c8460a5b8f473
-
SHA512
a52231ed9c670811395fc78c92afb605ef26dd18beb6180a157f2c68399a195d33dc59ee3eef412facde8e93b043e4e477fe2ab310649246d15ee23d20bfdb66
-
SSDEEP
98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4ulud:ovsJR0TW6yiIKRhzqOsd
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9cfe0e39c91f99fe5011e49716df789_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9cfe0e39c91f99fe5011e49716df789_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\38HOF.exe"C:\Users\Admin\AppData\Local\Temp\38HOF.exe" -Continue|"C:\Users\Admin\AppData\Local\Temp\e9cfe0e39c91f99fe5011e49716df789_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD5d52e07a5600d2c49a4b515fe5f7c7eb1
SHA1946eafbf9013ac9fb622bfbe74201a86ca400670
SHA256f9a670025bc6f14217bca9c737786f7e7970940e743501f779c7681412ffb741
SHA512c880013702e52aa1eb13da1ed03e41ead01ee63ae4ba930f23222807413f5d3c903abcd90dd93cff4fd345046e5af00120ec522004ae37c949193b852db9ef3e
-
Filesize
13KB
MD55a8e8dedf1d910c79defff5638978d07
SHA1bfab518af8a53f02c4f98fc321aa0984a208686c
SHA256d5bf8619a6f47e74aceb629da039f25493b0b8fb2f892bda2b32bd68c0cf8893
SHA5127acfc4d0bde75a518f394319c8cd6743d36eb7ebcdcd26eeae2fb59ead70bb8b4d2fb29be93c89b529775f8a407a9bcd6e4d2a2955c03b15f2880ff9aa61a519
-
Filesize
1.3MB
MD5a70486cf41bf065ff8e76e8619745361
SHA1e06e75380b17fec737fbdfeaa4a09b83e54d4838
SHA2561563fc1966e779f0fcb71753f15e73ec770e169a0ad6e3c5af736764d9bd5858
SHA51202f1c909fcbf7c0f5604ccb4e807640d80a2236c3cac6975e2e849bda318419e7188bb6a48184940eb381e2af375c83d7539e58951edf5e49ec11dd0cff66cc0
-
Filesize
10.8MB
-
Filesize
264KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
4.2MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
264KB
-
Filesize
64KB
-
Filesize
896KB
-
Filesize
64KB
-
Filesize
1.3MB