Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 05:06

General

  • Target

    f51892f6d4ee376d5b2472d51e5a6729_JaffaCakes118.exe

  • Size

    494KB

  • MD5

    f51892f6d4ee376d5b2472d51e5a6729

  • SHA1

    e68bc433795b01e2844f70dabaf512a519daadcd

  • SHA256

    11742b1b7437e34b15baafe3e44a7cf5a14d9b149ddb87499c42dd9fdbd5661a

  • SHA512

    f878b9f065894e0fe6449c0c1ca7fee4f1aacebc8925067d4af053bd7af0972dbce9a47814d864387fad13d7dad60352596c9975a177a1111aa5e79f6f0ad92f

  • SSDEEP

    12288:mnKfyxV2ImdvPGBFfi8WuJ6+1x0KCYT88VtX0n:WKfwV2HtPgFfN9/pD4

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f51892f6d4ee376d5b2472d51e5a6729_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f51892f6d4ee376d5b2472d51e5a6729_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Users\Admin\AppData\Local\Temp\n1245\s1245.exe
      "C:\Users\Admin\AppData\Local\Temp\n1245\s1245.exe" ins.exe /e 12488987 /u 52fe2c91-49dc-40b7-b209-1f140a000013 /v "C:\Users\Admin\AppData\Local\Temp\f51892f6d4ee376d5b2472d51e5a6729_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3760
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 4500
      2⤵
      • Program crash
      PID:4024
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1120 -ip 1120
    1⤵
      PID:1732

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\n1245\s1245.exe

      Filesize

      286KB

      MD5

      c268c937148a046322219b77c5a031b0

      SHA1

      e83ed15c7ef694a2281955a16ffeec0672c56107

      SHA256

      c913057e15ac6b27b204be58b52132d62901746075faa298bb0d08c84958d51e

      SHA512

      44cc28c7a707a37e49afdd23af42a620a8eb78f7b54913b41d8cd5eadd5ea37a6eb16e83d99dd75bbc736e70970a7c94b33d55950ed3dda45302477ea3868a19

    • memory/3760-11-0x00007FF8B28A0000-0x00007FF8B3241000-memory.dmp

      Filesize

      9.6MB

    • memory/3760-12-0x00007FF8B28A0000-0x00007FF8B3241000-memory.dmp

      Filesize

      9.6MB

    • memory/3760-15-0x0000000000E80000-0x0000000000E90000-memory.dmp

      Filesize

      64KB

    • memory/3760-26-0x000000001BA90000-0x000000001BA9A000-memory.dmp

      Filesize

      40KB

    • memory/3760-29-0x000000001C2E0000-0x000000001C7AE000-memory.dmp

      Filesize

      4.8MB

    • memory/3760-30-0x000000001C850000-0x000000001C8EC000-memory.dmp

      Filesize

      624KB

    • memory/3760-31-0x000000001B750000-0x000000001B758000-memory.dmp

      Filesize

      32KB

    • memory/3760-32-0x0000000000E80000-0x0000000000E90000-memory.dmp

      Filesize

      64KB

    • memory/3760-33-0x0000000000E80000-0x0000000000E90000-memory.dmp

      Filesize

      64KB

    • memory/3760-34-0x0000000000E80000-0x0000000000E90000-memory.dmp

      Filesize

      64KB

    • memory/3760-35-0x000000001F920000-0x000000001F982000-memory.dmp

      Filesize

      392KB

    • memory/3760-36-0x000000001FED0000-0x000000002000C000-memory.dmp

      Filesize

      1.2MB

    • memory/3760-37-0x0000000020520000-0x0000000020A2E000-memory.dmp

      Filesize

      5.1MB

    • memory/3760-38-0x0000000020A30000-0x0000000020B30000-memory.dmp

      Filesize

      1024KB

    • memory/3760-40-0x00007FF8B28A0000-0x00007FF8B3241000-memory.dmp

      Filesize

      9.6MB