Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/04/2024, 16:35

General

  • Target

    f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe

  • Size

    455KB

  • MD5

    f3e0c97a1e0e64bc94507da8c33c0c3c

  • SHA1

    cfa9da0e05afa966ea867fb02ea6e730d2cf5bcc

  • SHA256

    62b47f108b808d73be93bd323710a63252697d465701ac0e591a3b162fac2a10

  • SHA512

    2102a82fba5628997b7d9cf06e252dd22cdbac143fa0e7da9b6d19c49901a58e4e0802653b2b8e788aa340d0929a2a21613dc1415054afce2199285cb352ec55

  • SSDEEP

    12288:B5hV+0nRiW4SdUzWAenWRHcfoQwYl4Kb+YdoGP:B5hV+0nRiMHnWRHcfs64Kb+IoGP

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3512
      • C:\Users\Admin\AppData\Local\Temp\f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3057.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3744
          • C:\Users\Admin\AppData\Local\Temp\f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe"
            4⤵
            • Executes dropped EXE
            PID:4756
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2328

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      742KB

      MD5

      93c64775b0da3dc767d434755e8804e9

      SHA1

      b792daf10bad3aa77410925abe69bca39ca25030

      SHA256

      2b0101a133e7319a1c82d89d67fc69ea3928e1c536e99bda7912c1f89a59ae22

      SHA512

      cefb375d5cb603bb3f1c8f6911df30d02362f0e198051eacf8be98370bb903ca4e29596b8d4200baa8e4feb27cb630cfb7a80cdea144e248fc0b36439af1a7ed

    • C:\Users\Admin\AppData\Local\Temp\$$a3057.bat

      Filesize

      614B

      MD5

      116dfc414ad9cfbe5a2dcc4a95793809

      SHA1

      d10a4cd7cf5a98e92bb5c6a031162d80c9e44efa

      SHA256

      e9113a14c52583e49610d347b0de60296e89ac31cf5857d4b964a90012c47515

      SHA512

      21838f8d884a8fee84f6107ebe11333b70a302cf1ced6786338402a7ff574c8a20e10fe9bb55c93c8b4c4ce6835dccbef3001b60104146ed54f8798e34c84852

    • C:\Users\Admin\AppData\Local\Temp\f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe.exe

      Filesize

      397KB

      MD5

      5bbe43a54b8facc512f295204bcc6500

      SHA1

      f120f40a14a02760a4fd01406fd7d1deaf0c4cd9

      SHA256

      bf66dd32c448f5e80506c8cc9655dec8683f6047f998b0957f4660fc82668e10

      SHA512

      373a04f76073a8b3d65459e2aeccf0a83f96cc299d17a04fd5ccbfb9446e23e0842f2dcffa8335d34e664eb59f16ffe2138e5297f2e1b0dcb54ca0b0ca9dfafc

    • C:\Windows\Logo1_.exe

      Filesize

      58KB

      MD5

      57bd08d8c6a16851a4afd0d8721b761b

      SHA1

      c5cddfe47144ef3894b5a8c79223d517caeaa6eb

      SHA256

      718ca7af3c380624a309ed03974e1f5bd6b37fd51f0c94426d2a068340842a40

      SHA512

      6ede6d4b40b5aff48a7c5e04e7eb467a7afad2866f949e0568dfd40f2371da7ecbd492cb780a4d22b61798b7e1ee319fedd17efb506b329cdb6cd1807c680044

    • memory/2328-227-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB

    • memory/2540-6-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB