Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2024, 16:29

General

  • Target

    aaae520ac82fc05c94bea64b1d1c9002_JaffaCakes118.exe

  • Size

    140KB

  • MD5

    aaae520ac82fc05c94bea64b1d1c9002

  • SHA1

    7420d2377e3a0dd4b2ca5c4cc27c7ab979f30f82

  • SHA256

    36e496a71fbfeb31c69d1ce4835ea048577ca0e7bd038e73e8efbb18d2f8ab2a

  • SHA512

    67784fd56f8aa452fc58109010f0f0c49ac8589211193bd69e35b7a307720fbf92e3f095d17d46da5aae39ebbe1e76dec4da67356d2812e8d37bed779cd8146f

  • SSDEEP

    3072:i8UWylM4JDVPYuaAN0jlmKA5BDm5r8Wl7mGCKZXyDm5rNh:wlHX4AijdAvfO9XyY

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\aaae520ac82fc05c94bea64b1d1c9002_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\aaae520ac82fc05c94bea64b1d1c9002_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    PID:1124
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1308,i,3144109701624127473,12586215149656995128,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8
    1⤵
      PID:4312

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nssD831.tmp\INetC.dll

      Filesize

      25KB

      MD5

      40d7eca32b2f4d29db98715dd45bfac5

      SHA1

      124df3f617f562e46095776454e1c0c7bb791cc7

      SHA256

      85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

      SHA512

      5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

    • C:\Users\Admin\AppData\Local\Temp\nssD831.tmp\System.dll

      Filesize

      12KB

      MD5

      8cf2ac271d7679b1d68eefc1ae0c5618

      SHA1

      7cc1caaa747ee16dc894a600a4256f64fa65a9b8

      SHA256

      6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

      SHA512

      ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3