Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 18:41

General

  • Target

    ebbd6fd97bc0685a385126c92c6917fd_JaffaCakes118.dll

  • Size

    1.3MB

  • MD5

    ebbd6fd97bc0685a385126c92c6917fd

  • SHA1

    a9259be57b32b5178c8f2d48569c1778462a9743

  • SHA256

    da77c3e9f2a3e8ae8bce8df16229b63faa26fe8c53dff1d79b1313829f4fa887

  • SHA512

    aa743409730aeb4035e86691bffaf92e226ea2cc09ea2dd8d3007bb754ee1c429d890405e74644ac7e313200d14e024d0a2bf5ef75ef01d400255b89c68b6709

  • SSDEEP

    24576:GtE5co3MnQXOCQevEQBX1tYrPTnhwWpMCBd4uOMG:GLjQXOg1Kvn7/G

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebbd6fd97bc0685a385126c92c6917fd_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4988
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebbd6fd97bc0685a385126c92c6917fd_JaffaCakes118.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Users\Admin\AppData\Local\Temp\e584716.exe
        "C:\Users\Admin\AppData\Local\Temp\e584716.exe"
        3⤵
        • Executes dropped EXE
        PID:3124
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 808
          4⤵
          • Program crash
          PID:384
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3124 -ip 3124
    1⤵
      PID:5112

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\e584716.exe

      Filesize

      21KB

      MD5

      858939a54a0406e5be7220b92b6eb2b3

      SHA1

      da24c0b6f723a74a8ec59e58c9c0aea3e86b7109

      SHA256

      a30f30a109cb78d5eb1969f6c13f01a1e0a5f07b7ad8b133f5d2616223c1ce0a

      SHA512

      8875d1e43ea59314695747796894a2f171e92f7b04024dbc529af1497331489e279cd06ea03061288089d2f07ad437178b9d62f0bae2e16ae0b95c5681569401

    • memory/1640-12-0x0000000003740000-0x00000000037D4000-memory.dmp

      Filesize

      592KB

    • memory/1640-1-0x0000000002DA0000-0x0000000002E7F000-memory.dmp

      Filesize

      892KB

    • memory/1640-3-0x0000000002F40000-0x0000000002FEF000-memory.dmp

      Filesize

      700KB

    • memory/1640-4-0x0000000003000000-0x000000000309C000-memory.dmp

      Filesize

      624KB

    • memory/1640-5-0x0000000003000000-0x000000000309C000-memory.dmp

      Filesize

      624KB

    • memory/1640-7-0x0000000003000000-0x000000000309C000-memory.dmp

      Filesize

      624KB

    • memory/1640-8-0x0000000000400000-0x0000000000546000-memory.dmp

      Filesize

      1.3MB

    • memory/1640-10-0x0000000003000000-0x000000000309C000-memory.dmp

      Filesize

      624KB

    • memory/1640-0-0x0000000002630000-0x0000000002631000-memory.dmp

      Filesize

      4KB

    • memory/1640-11-0x00000000030A0000-0x000000000373D000-memory.dmp

      Filesize

      6.6MB

    • memory/1640-17-0x0000000000A40000-0x0000000000A44000-memory.dmp

      Filesize

      16KB

    • memory/1640-16-0x00000000037E0000-0x000000000386E000-memory.dmp

      Filesize

      568KB

    • memory/1640-13-0x00000000037E0000-0x000000000386E000-memory.dmp

      Filesize

      568KB

    • memory/1640-18-0x0000000000A50000-0x0000000000A56000-memory.dmp

      Filesize

      24KB

    • memory/1640-20-0x0000000002DA0000-0x0000000002E7F000-memory.dmp

      Filesize

      892KB

    • memory/1640-22-0x0000000002E80000-0x0000000002F36000-memory.dmp

      Filesize

      728KB

    • memory/1640-2-0x0000000002E80000-0x0000000002F36000-memory.dmp

      Filesize

      728KB

    • memory/3124-36-0x00000000009C0000-0x00000000009C8000-memory.dmp

      Filesize

      32KB

    • memory/3124-37-0x0000000072F70000-0x0000000073720000-memory.dmp

      Filesize

      7.7MB

    • memory/3124-39-0x0000000072F70000-0x0000000073720000-memory.dmp

      Filesize

      7.7MB