Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2024, 19:16

General

  • Target

    aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe

  • Size

    21.1MB

  • MD5

    aff24f3d5b86c1a8592b38b609350c54

  • SHA1

    3f28f02e948095e8e3f3a2abd3328fbc281ea7b7

  • SHA256

    d79db4c19cb70ffec4ac9c75564a51069fea23a8839d3f0267eae20d9ee1f9e4

  • SHA512

    dd390400957bad58621f67184924e6bf6764f393121da705c08d7e7b9bf573169b2697dc840dd26b96fc45ded24d687eda6c833e5e68edccd3d24c6d7dc92065

  • SSDEEP

    393216:5VjSEPbi7v4SUJIS7kqyOOmUa07h9FI+gB0hLuhu4D3f/s2dXhMEv:zdy4PIS7kHdaiLFGg4D3f/sov

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4820
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1939202 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-4124900551-4068476067-3491212533-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:1404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    9bdcf813d65265255b820bc7a704da3c

    SHA1

    dad6501711992ab874d778ece5a103e143fd42d7

    SHA256

    b15d67b4a57184e5202df3c25e20dc0b7f853f4d527d148b337138900989824a

    SHA512

    53cac68a57194ec33ccc5c212a6b82bc554e85c86faab4e095876f5c037f680c646ce8463857e61438b92cb7ca7c17efea1d713a9d772d9f2afeb5ddd17b6504

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    322KB

    MD5

    c3f5f4a1fb69b5889f0bbb313cf6017f

    SHA1

    e4f592cfbd62a3c3caf27177ccea5a77afa649bb

    SHA256

    769416fa7edf38e91a55f4f7163914ee4aad9c8c890ed641c300b73157acac45

    SHA512

    e17d3be36fd2ba892d945f3737ebffdefe6d476224ef3459b567579971559a048a886941f57ae671b3df32844f99575a14c72ef8c49c2d4b1e8352204ccc05ab

  • memory/1404-14-0x0000000000D50000-0x0000000001137000-memory.dmp

    Filesize

    3.9MB

  • memory/1404-26-0x0000000000D50000-0x0000000001137000-memory.dmp

    Filesize

    3.9MB