Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    6s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/05/2024, 20:33

General

  • Target

    6c2c5d6659efb231d9ad581c9bc2a98e_JaffaCakes118.exe

  • Size

    436KB

  • MD5

    6c2c5d6659efb231d9ad581c9bc2a98e

  • SHA1

    feab504fed043f6c76af14a090496b19fef75f44

  • SHA256

    96e0f2a803195e87752de63e91566dfe74b565d80e3c36efd90d85ec1b3be632

  • SHA512

    da89c4d71aa5251dd94e382488cc35ed23893c8c0fe7bf724108acde6775ed63db01f621337cc8c7f291c9b380769452f9558379ff391729f2dbe507747d9ace

  • SSDEEP

    12288:ZnISpUE+pgz1ON4gwT+tBMjFzrAyxA46elD0I0/UiQTN:ySOE+pgAuOcz7Ak0/UiW

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c2c5d6659efb231d9ad581c9bc2a98e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6c2c5d6659efb231d9ad581c9bc2a98e_JaffaCakes118.exe"
    1⤵
      PID:5112
      • C:\Users\Admin\AppData\Local\Temp\6c2c5d6659efb231d9ad581c9bc2a98e_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\6c2c5d6659efb231d9ad581c9bc2a98e_JaffaCakes118.exe"
        2⤵
          PID:1212
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 680
            3⤵
            • Program crash
            PID:4556
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4180,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8
        1⤵
          PID:3024
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1212 -ip 1212
          1⤵
            PID:428

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\glossitis.dll

            Filesize

            72KB

            MD5

            38e1a078aaf0a8feea3d3a6317b6e85e

            SHA1

            5b35cbdd235366eac93d409e7b5cfe43db444f64

            SHA256

            c193d53bc725e9ddcea48506f4f48bea90e665fa145a12ac1a6d1ddd0f6e113b

            SHA512

            2b7987f4598d9831e3f53182117e0ca49ead034358211b8fe5ae13377d9950591bf87468c12e315caf575db82cc5d0c46f0d67059d340d4fe2543dba0bc98c35

          • C:\Users\Admin\AppData\Local\Temp\nsj27C8.tmp\System.dll

            Filesize

            11KB

            MD5

            a436db0c473a087eb61ff5c53c34ba27

            SHA1

            65ea67e424e75f5065132b539c8b2eda88aa0506

            SHA256

            75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

            SHA512

            908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

          • memory/1212-24-0x0000000002DC0000-0x0000000002E7E000-memory.dmp

            Filesize

            760KB

          • memory/1212-22-0x0000000000480000-0x0000000000489000-memory.dmp

            Filesize

            36KB

          • memory/1212-15-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

          • memory/1212-14-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

          • memory/1212-18-0x0000000002210000-0x0000000002216000-memory.dmp

            Filesize

            24KB

          • memory/1212-17-0x0000000000480000-0x0000000000489000-memory.dmp

            Filesize

            36KB

          • memory/1212-16-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

          • memory/1212-34-0x00000000039F0000-0x0000000003B1A000-memory.dmp

            Filesize

            1.2MB

          • memory/1212-26-0x0000000003220000-0x00000000033C1000-memory.dmp

            Filesize

            1.6MB

          • memory/1212-21-0x0000000002210000-0x0000000002216000-memory.dmp

            Filesize

            24KB

          • memory/1212-13-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

          • memory/1212-25-0x0000000002E80000-0x0000000003149000-memory.dmp

            Filesize

            2.8MB

          • memory/1212-19-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

          • memory/1212-36-0x0000000003B20000-0x0000000003BBB000-memory.dmp

            Filesize

            620KB

          • memory/1212-35-0x0000000003920000-0x00000000039CC000-memory.dmp

            Filesize

            688KB

          • memory/1212-33-0x0000000003840000-0x00000000038DE000-memory.dmp

            Filesize

            632KB

          • memory/1212-32-0x00000000036F0000-0x0000000003720000-memory.dmp

            Filesize

            192KB

          • memory/1212-31-0x00000000035B0000-0x00000000036B0000-memory.dmp

            Filesize

            1024KB

          • memory/1212-30-0x0000000003510000-0x00000000035AD000-memory.dmp

            Filesize

            628KB

          • memory/1212-29-0x0000000003400000-0x000000000350B000-memory.dmp

            Filesize

            1.0MB

          • memory/1212-28-0x00000000033D0000-0x00000000033FB000-memory.dmp

            Filesize

            172KB

          • memory/1212-27-0x0000000002230000-0x0000000002252000-memory.dmp

            Filesize

            136KB

          • memory/5112-10-0x0000000002270000-0x0000000002284000-memory.dmp

            Filesize

            80KB