Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/06/2024, 04:50

General

  • Target

    02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe

  • Size

    42KB

  • MD5

    02efe4c0b1e4e264b9ce097bb41f8e21

  • SHA1

    471fb4bf07d3be53d7c440ccdc42e9d4a586dc5f

  • SHA256

    7089e7b7ded8edf01674085e4f891cc73dc4c104b1dbc0f643a3d35971f1dc2e

  • SHA512

    32da8b24f2a0d86081740238a3e17030643e21ecac98b0bab226e97649c06005a9dfbe52ccec7373d4f63bd3de9b59dfdf8fa923fc8ef179f5b4838579d78511

  • SSDEEP

    768:X/VrQUqTQEHGWJrt+E8ASirfEyjS9V0q8ksYEpoKhHXQ4twMJJvG9qzY1xQV:X5PeQUGWlIE8+cmSEq8pYEFhHFXsxu

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
      2⤵
        PID:2016

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\a..bat

      Filesize

      238B

      MD5

      ace6bcc7870496ac839d9a17c7a83a88

      SHA1

      11c4270a6f24cd5564b3e5b671fae16e26a63a71

      SHA256

      ded8c50a149ad4a0bc1caa40642f6dba619b2781860fe789babbeb0e434a08b5

      SHA512

      f4b8b9d1a143906dee32d8c291be9b9f77ebe90a3802718c698a3799cf95f325f13e93cbdc6bc073d824c58c61ec02c7e6315e2bc73a8277747ea8676a69441e

    • memory/4984-0-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/4984-1-0x0000000000460000-0x0000000000461000-memory.dmp

      Filesize

      4KB

    • memory/4984-4-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB