Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 09:37

General

  • Target

    804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe

  • Size

    233KB

  • MD5

    804a1f003f4942d4c81c6d221ef10e8f

  • SHA1

    3c91d9723ece75f2c98782739ce0fb3c6f60dbda

  • SHA256

    8613cef95caf6fce398e47856b320392b5fc0e940c891a3cc512562f29361b8a

  • SHA512

    3d1256063708aa91c59b730ecdcd8ad6b3270e49a8808d4d216aaca0e8cffc70e8814965de284e341e2af51d13b29b900614fdcd1de658bae5b90fcf057f5634

  • SSDEEP

    6144:4xyMeM8tKmy/q7RglyFlqsGnK48uGSiU4pt6:4xyMehti/8R7lJEGSiU4C

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\9d54a49b-ca03-4657-b311-d91ea847f32c\start.hta
      2⤵
        PID:2420

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\9d54a49b-ca03-4657-b311-d91ea847f32c\helper.dll

      Filesize

      122KB

      MD5

      47cb6d4a317540d0fbbdbf813bd24d7f

      SHA1

      fdf0ca931b67bda1c62c157357dfb0729b9e9ee8

      SHA256

      d376d8192ece1fe69a9ec5a77fb512c41a3fe55417478635d7fe2d874e0ed49e

      SHA512

      1fb63ab4d7fb8fcc26f4c9333bbfa893b1253606035df6be8bfa2188e363372999f517bf63f061fa96047c5529a4170fc55c1f67828ae87c8a47b4b2362a1f80

    • C:\Users\Admin\AppData\Local\Temp\9d54a49b-ca03-4657-b311-d91ea847f32c\loader.gif

      Filesize

      1KB

      MD5

      e88ebd85dd56110ac6ea93fe0922988e

      SHA1

      684a31d864d33ff736234c41ac4e8d2c7f90d5ae

      SHA256

      379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb

      SHA512

      211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7

    • C:\Users\Admin\AppData\Local\Temp\9d54a49b-ca03-4657-b311-d91ea847f32c\start.hta

      Filesize

      1KB

      MD5

      1e0053dfeeecf4c16284d6dad4fd86f4

      SHA1

      fe4ca30de707e1f77e5e258f62007f82633b6773

      SHA256

      e2d32f98e234880b02f55506b75e13ec992ed53f39c35c19bef070b081eea3bb

      SHA512

      5fb547735e5516f95ecb68bc5f862c7af963fe415a3aee9f2e4671473d1dbe36c65e2e2760900b96a81f5d27cb49b6f68c2f10d310ede93963ad78eea691e76b