Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 04:50
Behavioral task
behavioral1
Sample
02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe
-
Size
42KB
-
MD5
02efe4c0b1e4e264b9ce097bb41f8e21
-
SHA1
471fb4bf07d3be53d7c440ccdc42e9d4a586dc5f
-
SHA256
7089e7b7ded8edf01674085e4f891cc73dc4c104b1dbc0f643a3d35971f1dc2e
-
SHA512
32da8b24f2a0d86081740238a3e17030643e21ecac98b0bab226e97649c06005a9dfbe52ccec7373d4f63bd3de9b59dfdf8fa923fc8ef179f5b4838579d78511
-
SSDEEP
768:X/VrQUqTQEHGWJrt+E8ASirfEyjS9V0q8ksYEpoKhHXQ4twMJJvG9qzY1xQV:X5PeQUGWlIE8+cmSEq8pYEFhHFXsxu
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation 02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/4984-0-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/4984-4-0x0000000000400000-0x0000000000413000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4984 wrote to memory of 2016 4984 02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe 91 PID 4984 wrote to memory of 2016 4984 02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe 91 PID 4984 wrote to memory of 2016 4984 02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul2⤵PID:2016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238B
MD5ace6bcc7870496ac839d9a17c7a83a88
SHA111c4270a6f24cd5564b3e5b671fae16e26a63a71
SHA256ded8c50a149ad4a0bc1caa40642f6dba619b2781860fe789babbeb0e434a08b5
SHA512f4b8b9d1a143906dee32d8c291be9b9f77ebe90a3802718c698a3799cf95f325f13e93cbdc6bc073d824c58c61ec02c7e6315e2bc73a8277747ea8676a69441e