Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    124s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 11:30

General

  • Target

    fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe

  • Size

    33KB

  • MD5

    fa33c5fd62cb1a2f3077dceea84f441e

  • SHA1

    419891ae4bff67b7c321e0d1b650926525c3c122

  • SHA256

    77722664a92042f699f0a7a8de15a0c553ecaa152d3099bf33a7beb3d4790602

  • SHA512

    cd176079d506cac51a619033e419a13bc83a8122319338b6cb895ee3157eae17d238812f35acaa58a074ed6e360ee0197fa1b6228d0081d2cfaf1772df8c2af4

  • SSDEEP

    768:6lz/yURinnljkQHMBQig88QE2vjKpCgJ6Xp6s/wJJn5Pu:izj4loW/INYCgJc0JJo

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\dt.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3244
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K c:\windows\temp\r.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\Windows\SysWOW64\net.exe
          net stop sharedaccess
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2176
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop sharedaccess
            5⤵
              PID:3756
          • C:\Windows\SysWOW64\ftp.exe
            ftp -s:c:\windows\temp\f.txt
            4⤵
              PID:1168
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3936,i,10943981808815347339,15838841970612097850,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
        1⤵
          PID:3592

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\dt.bat

          Filesize

          1KB

          MD5

          676afdfa824e13b72aecaf6d0d65fa6c

          SHA1

          f5e918c9fe29a9b432be38b812a6087f4a49bff2

          SHA256

          896520460c090bcacba8cf6f633abf2e4c6e01c8284737b60b1f51063246e72a

          SHA512

          4ac34dd1eb77862206dc608c9b57e2956857407b7c5eced45c20b6577e2d53755254fd38300a2b7d02624c37a652ade86add230cd33c452bec380688f414f633

        • C:\Windows\Temp\f.txt

          Filesize

          76B

          MD5

          e492c90155bb26e6c57c202780f35093

          SHA1

          83d3d0a8af4fbcd3b70a22611578ef5b5966fcb9

          SHA256

          ff07e608a348217c1306a1ff202f9b91fddf104b9367c4ee911bccefe04edb94

          SHA512

          b3265b4f58966441813a0da9032d68e061dcbe6213f82b10f83addafe93627d66637105b443534fac8e074340ff50e07e14437309ad88befc774d2daf5286259

        • \??\c:\windows\temp\r.bat

          Filesize

          164B

          MD5

          f22ad73544c4463a4fe267ed2c646a20

          SHA1

          9faba5662a5f43fad4df2182fb3c45199cd316c8

          SHA256

          188e171e17dad12fa1b8067a8b86bc113c0f9df9d9ef03e89006f9c3f7c51c98

          SHA512

          2c52ceee850adbb90863452815d60596931c485c921ef1a7c3ed8d0de028cbbfc561d62e25beb63410e867da63ebfef6c7cf0f2d1cb75fe13e566731f4df2abd