Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2024, 11:00

General

  • Target

    ae1c2fa9ee7e4bec38961a9d8e26c999_JaffaCakes118.exe

  • Size

    675KB

  • MD5

    ae1c2fa9ee7e4bec38961a9d8e26c999

  • SHA1

    9c60fbf6b7e379acdd6b13f6ffd03400b7b736de

  • SHA256

    24c5a866f0e318e090430abd9b76a5ba5b07afbccfefee80a670009db8a04f0f

  • SHA512

    c3c393f1fe4b8156fc690dac5ca4e6d432ac09abee3604c2b26f9010fdb4b21a315264614e6a787b3341ba80ef8087c47eb1e33d653049d572bc31281c05c06e

  • SSDEEP

    12288:5pPEsv7Q2mJDPBvNb++Pdzjj7Qbdb/XxOGJO9KqyRj334p2nh6w:zPEsvMX1Nnlb7QbFX1J4K5jYp2nh6w

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae1c2fa9ee7e4bec38961a9d8e26c999_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ae1c2fa9ee7e4bec38961a9d8e26c999_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4484
    • C:\Users\Admin\AppData\Local\Temp\n5578\s5578.exe
      "C:\Users\Admin\AppData\Local\Temp\n5578\s5578.exe" 57088cbabce727b8381d2630O+bdhcf8k9JN4lawOmLY20HsQ5MtLS0F+F2FRNLqMyLPz8iPU747olmOsu/182r9eR1FBCu4ZOXnSQQX2Gktmd6kqCF3c9Ph0iyrBzccGv5T2Hv5xJ4WK1YrLwMajaReRU8WPE+Iy1UJ7Xn8WET/aX13xMM6xC73sZT8Ulf0QA== /v "C:\Users\Admin\AppData\Local\Temp\ae1c2fa9ee7e4bec38961a9d8e26c999_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\n5578\s5578.exe

    Filesize

    350KB

    MD5

    4316f8dd279ce879833a07ee5083979e

    SHA1

    4977e56fd1ae2cbec43e715ff29890be8a415ddb

    SHA256

    72adc6a10a81e294ee987eb1dcd9fbe206d77c103ee517dfce00493b38162a63

    SHA512

    dd40d9c2ccc7a4c77617a5e0976a442cb4480ca0898c81463812466785b81ac1ccd918f107278259a4a515cdf881d35a7d5359d1678791343319ae9841349646

  • memory/3488-12-0x00007FFA541A5000-0x00007FFA541A6000-memory.dmp

    Filesize

    4KB

  • memory/3488-13-0x00007FFA53EF0000-0x00007FFA54891000-memory.dmp

    Filesize

    9.6MB

  • memory/3488-14-0x000000001BB10000-0x000000001BB20000-memory.dmp

    Filesize

    64KB

  • memory/3488-17-0x000000001C8F0000-0x000000001CDBE000-memory.dmp

    Filesize

    4.8MB

  • memory/3488-18-0x000000001CE60000-0x000000001CEFC000-memory.dmp

    Filesize

    624KB

  • memory/3488-19-0x00007FFA53EF0000-0x00007FFA54891000-memory.dmp

    Filesize

    9.6MB

  • memory/3488-20-0x000000001D050000-0x000000001D0B2000-memory.dmp

    Filesize

    392KB

  • memory/3488-21-0x00007FFA53EF0000-0x00007FFA54891000-memory.dmp

    Filesize

    9.6MB

  • memory/3488-22-0x000000001BEE0000-0x000000001BEE8000-memory.dmp

    Filesize

    32KB

  • memory/3488-23-0x00007FFA53EF0000-0x00007FFA54891000-memory.dmp

    Filesize

    9.6MB

  • memory/3488-24-0x00007FFA53EF0000-0x00007FFA54891000-memory.dmp

    Filesize

    9.6MB

  • memory/3488-25-0x00007FFA541A5000-0x00007FFA541A6000-memory.dmp

    Filesize

    4KB

  • memory/3488-26-0x00007FFA53EF0000-0x00007FFA54891000-memory.dmp

    Filesize

    9.6MB

  • memory/3488-27-0x00007FFA53EF0000-0x00007FFA54891000-memory.dmp

    Filesize

    9.6MB

  • memory/3488-28-0x00007FFA53EF0000-0x00007FFA54891000-memory.dmp

    Filesize

    9.6MB

  • memory/3488-29-0x00007FFA53EF0000-0x00007FFA54891000-memory.dmp

    Filesize

    9.6MB

  • memory/3488-30-0x00007FFA53EF0000-0x00007FFA54891000-memory.dmp

    Filesize

    9.6MB

  • memory/3488-31-0x0000000020FC0000-0x00000000214CE000-memory.dmp

    Filesize

    5.1MB

  • memory/3488-33-0x00007FFA53EF0000-0x00007FFA54891000-memory.dmp

    Filesize

    9.6MB