Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 18:29

General

  • Target

    427f9af153644266aa3fe01f474a4ef2_JaffaCakes118.exe

  • Size

    489KB

  • MD5

    427f9af153644266aa3fe01f474a4ef2

  • SHA1

    d5807049d228d8298b66c3e7e921b4c9d31858fb

  • SHA256

    336462837bfc8d6a959b86fd0394b748fc4f5fda61ddb2dc1319bbe3d1041372

  • SHA512

    c903c3f89751bdf50b464ee28ed954d7ce05a1944318e35393b437afd83c644f091a0c631138fb09d90ffcdf922da59fdff00f3808b15847d6c6e6a491dec8e4

  • SSDEEP

    12288:4mDIx6thES517fvsczPwo5CL4FB5uBRfAA7p87uxCzb/zNs2fNbMoD:4mDIx6thEm17f/te4P5uPfJ7pOuUTN/V

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\427f9af153644266aa3fe01f474a4ef2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\427f9af153644266aa3fe01f474a4ef2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Users\Admin\AppData\Local\Temp\befacghgbc_P.exe
      C:\Users\Admin\AppData\Local\Temp\befacghgbc_P.exe 0^4^1^6^9^8^9^4^2^8^8 L0xIPjQpMDQyKhgvT1Q8R0E7OS4YJ05BU1FGSkJFQjUoICtDQ0pMQEA7KBgvP0g+NCgXK05KR0RRQk5WQTs5LhgnU0FRUDxKVlFQRDVocHNqMScmb3BuJkRBUkUkTEZMKzlIUCpISD1HFytBREFDR0g+NBgmQC81JTEcLj4pNSQtHic8MzksKxcnOzA7JSkgK0MvNCUoHC1ISk9AVD1LV0dOR045Q1U8GiZISUtCTTtUW0RPQzk0HC1ISk9AVD1LV0U9Sz01ICtEUjxXTE5KNRgvQVc/VjtEQEpBRkU5Hyk/R0pQXTpKT1NSP0k1LBwtTEBBSkpTRk1WUVBENSArVUc0KhcrQkspPRwuTExGS0VLPVdXQUs9RkU8RUs5P0VRUUY0GCZFUVdKVUpTQ0Q9NHBwbV0gK1E/S01JSkdGP19RUj9JVzs9V0s1MhwuQkA8PFQ7KRgvRVJZO1FFPUtBO19BTT1JUUdQQzw1Zl1rbVwYJkBNT0ZMS0A+VkFHOTAoMC4tMColMSoqLyoqICtPO0k5Q0hDRFdJSlJOOERDOXJqbWUcLk5ARTw5LywtMC44Li0sMBwtPEdXSktJODxWUEdFPT0tMSkoLiYuLiktKjM5LS4yKTUoSEU=
      2⤵
      • Executes dropped EXE
      PID:3980
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 228
        3⤵
        • Program crash
        PID:4868
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3980 -ip 3980
    1⤵
      PID:3680

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\befacghgbc_P.exe

      Filesize

      674KB

      MD5

      874fbb12caacbf56e2e02b37634218ca

      SHA1

      721b1d3923c7eb3dcbcae0b7b839918aaa0340c1

      SHA256

      54f132d1bc338089c3ffbe65944c3c375917a860c2d146db98ad7fdca413bcaa

      SHA512

      03f397ed707117422a7dfebce47b4a87ac494827d42854e34c547255b02169d14ae6eeb3ff2b34ae9e59bacfe452daef49a14a4f9eda8ece672679255d46c4c6