Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 12:36

General

  • Target

    a0b0c07d9e1e67ab1b534b43c2a04df8_JaffaCakes118.exe

  • Size

    412KB

  • MD5

    a0b0c07d9e1e67ab1b534b43c2a04df8

  • SHA1

    867754d8388c96e44673cf75e60d4157a93d7fae

  • SHA256

    055bcc3e5db76a4ad7cb26e4fe049ccdb0374b809dbc7582bf5580865aa2ba4c

  • SHA512

    01187c2ecc86349afc7ef34b068f95ec1accd7942043b14339b98db7dcbe925d2ca7462bc92fdcefd6ae62213ecc837d0513226cc95a5594bb0ea000374d29b9

  • SSDEEP

    6144:HlH5Bs1sdLrqv+w/sCQrBAOKAOpCbDjyobyFGpSlKTgPVpnNC8fOSQFZb:HJFYsCQrBQ+PLe3+zqGZb

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0b0c07d9e1e67ab1b534b43c2a04df8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a0b0c07d9e1e67ab1b534b43c2a04df8_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3416
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" c:\23cf174c-af17-46d1-b0f6-bcd4133d874b\start.hta
      2⤵
        PID:224
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1060,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
      1⤵
        PID:3284

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\23cf174c-af17-46d1-b0f6-bcd4133d874b\InstallerHelper.dll

        Filesize

        132KB

        MD5

        c06e556b36a2fc56506f65fcbf9d68b1

        SHA1

        ab2709f812271c2d7fbd1eb69d2ccf62cc41de95

        SHA256

        38b2344ce31905ea71c7e401d48c5643fe7b2e40001efd00c422221f940b06f8

        SHA512

        667e0a10b647d638e4ce295cb2bb91a9035d45bbec8bf1b143b79dc1666fdaecbbe06eb92f27fdf9e10da2f0da2cec7bce9d906da1c8cd30f84b209e9b179e4e

      • \??\c:\23cf174c-af17-46d1-b0f6-bcd4133d874b\loader.gif

        Filesize

        1KB

        MD5

        e88ebd85dd56110ac6ea93fe0922988e

        SHA1

        684a31d864d33ff736234c41ac4e8d2c7f90d5ae

        SHA256

        379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb

        SHA512

        211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7

      • \??\c:\23cf174c-af17-46d1-b0f6-bcd4133d874b\start.hta

        Filesize

        1KB

        MD5

        db4ada697fa7a0e215281533d52578e9

        SHA1

        fb755ea8371edf5065dc53e21eb413603f9eba7f

        SHA256

        f949fd6ca734830572128b4348dfd039419140c7ef501d80773f71ca3f0ed78c

        SHA512

        9ba1d2658785dd3c88b4399132f8330dc58872235e19ca9854b0e453d8cc7a58de0c8be84da376a72b5851073f531c95b2c6afa84f43053561ca8e6751d6e2f3