Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 08:19

General

  • Target

    f55bd52204f0fc76d87bbb945696f517_JaffaCakes118.exe

  • Size

    352KB

  • MD5

    f55bd52204f0fc76d87bbb945696f517

  • SHA1

    d1adabe06c66464b6f5dbce63772042e01f1cca1

  • SHA256

    155334fff7afe725df481323fc38b5f7f75a33cd116bea8066254e69429e90f3

  • SHA512

    d9c2ac2cc2eba5f07c4516ef3ed2d80652f460b7d0d7a9c992d005f4c08fed98efd23e8c09644310fafc97c375a99c4f6408283bb76eda145fc3446e4e6850ce

  • SSDEEP

    6144:peAhFLiInTFjKqAGbKg+NCG8GCww0IdLtdXOabph4j2JsFTAw2Tn6PXcdZqj8u6:8lInTVDAGbNcCkw02dXOXdvj8u6

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\f55bd52204f0fc76d87bbb945696f517_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f55bd52204f0fc76d87bbb945696f517_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Drops file in Windows directory
    PID:4008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4008-0-0x0000000000670000-0x0000000000671000-memory.dmp

    Filesize

    4KB

  • memory/4008-1-0x0000000000C30000-0x0000000000C31000-memory.dmp

    Filesize

    4KB

  • memory/4008-2-0x0000000000C50000-0x0000000000C51000-memory.dmp

    Filesize

    4KB

  • memory/4008-3-0x0000000000C70000-0x0000000000C71000-memory.dmp

    Filesize

    4KB

  • memory/4008-4-0x0000000000C60000-0x0000000000C61000-memory.dmp

    Filesize

    4KB

  • memory/4008-5-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

    Filesize

    4KB

  • memory/4008-6-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

    Filesize

    4KB

  • memory/4008-7-0x0000000000D00000-0x0000000000D01000-memory.dmp

    Filesize

    4KB

  • memory/4008-9-0x0000000000D30000-0x0000000000D31000-memory.dmp

    Filesize

    4KB

  • memory/4008-10-0x0000000000DB0000-0x0000000000DDF000-memory.dmp

    Filesize

    188KB

  • memory/4008-8-0x0000000000D10000-0x0000000000D11000-memory.dmp

    Filesize

    4KB

  • memory/4008-13-0x0000000000D50000-0x0000000000D51000-memory.dmp

    Filesize

    4KB

  • memory/4008-12-0x0000000000D40000-0x0000000000D41000-memory.dmp

    Filesize

    4KB

  • memory/4008-15-0x0000000000D70000-0x0000000000D71000-memory.dmp

    Filesize

    4KB

  • memory/4008-17-0x0000000000D80000-0x0000000000D81000-memory.dmp

    Filesize

    4KB

  • memory/4008-18-0x0000000000D90000-0x0000000000D91000-memory.dmp

    Filesize

    4KB

  • memory/4008-19-0x0000000000D20000-0x0000000000D21000-memory.dmp

    Filesize

    4KB

  • memory/4008-20-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

    Filesize

    4KB

  • memory/4008-21-0x0000000000C80000-0x0000000000C81000-memory.dmp

    Filesize

    4KB

  • memory/4008-25-0x0000000000D60000-0x0000000000D61000-memory.dmp

    Filesize

    4KB

  • memory/4008-26-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

    Filesize

    4KB

  • memory/4008-27-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

    Filesize

    4KB

  • memory/4008-28-0x0000000000E00000-0x0000000000E01000-memory.dmp

    Filesize

    4KB

  • memory/4008-29-0x0000000000E20000-0x0000000000E21000-memory.dmp

    Filesize

    4KB

  • memory/4008-40-0x0000000003EA0000-0x0000000003EA1000-memory.dmp

    Filesize

    4KB