Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/06/2024, 05:32

General

  • Target

    033f879ac1a4b31edc7d5dd46f62f2cd_JaffaCakes118.exe

  • Size

    208KB

  • MD5

    033f879ac1a4b31edc7d5dd46f62f2cd

  • SHA1

    55ee6e1a5babdc7fa51c4c64f2967b575f565292

  • SHA256

    43aeb4b384c8ef54a9945bbc32b9e22ceada39b48d0d645255f67d55e6f968e7

  • SHA512

    8048b2658a9d76e5f0cf966af42cd77b50b5282341820d1fcb9e7d79867a2e26abc7edf06bb0562328a446c65d70b5e2a6c841b5bc42b42ccff6bba2502a6b16

  • SSDEEP

    3072:wVHgCc4xGvbwcU9KQ2BBAHmaPxNVoOb5EU:NCc4xGxWKQ2BonxZ

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\033f879ac1a4b31edc7d5dd46f62f2cd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\033f879ac1a4b31edc7d5dd46f62f2cd_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Program Files (x86)\f06fefdb\jusched.exe
      "C:\Program Files (x86)\f06fefdb\jusched.exe"
      2⤵
      • Executes dropped EXE
      PID:3980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\f06fefdb\f06fefdb

    Filesize

    17B

    MD5

    134c1d489094d6d3399f65b0e9aebc1f

    SHA1

    612a57fbe6ed3ab9c15b39451171d813314a28d5

    SHA256

    54f9150d1268f7b4b83dd9fc3ec32274bf749715a5806ff3ca5262f5427d6781

    SHA512

    b09bf60e4850d05261d81a124a647dd111f42480224eae8a3bd2f64736c38119953703f868ad34194a7ae6dad6aabff4081ba73df262bbe9f5327867c56a48ed

  • C:\Program Files (x86)\f06fefdb\jusched.exe

    Filesize

    208KB

    MD5

    c480e6370fb7d83040a74f817ce7618c

    SHA1

    ae8754c3b0af86356c6b7518c4f0db9eef1a493e

    SHA256

    ba31d0e466e864db2ef6c702c0e48d04a24e3e04285458a6fdc98a00af35a374

    SHA512

    78cab1761515ffbb1e0d6b7e5b629f048ec290bfb4ab4b7400577a7b99829f1386d5f0fbb994acd5116cf1f89ece1124ca1efa0a612a9adb1f4a3c2c4779d4d6

  • memory/1800-0-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1800-13-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/3980-15-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB