Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 09:01

General

  • Target

    0797ae480b07fb4e00b16482cf5435cb_JaffaCakes118.exe

  • Size

    144KB

  • MD5

    0797ae480b07fb4e00b16482cf5435cb

  • SHA1

    51b2a74528a90c5c8a0d7eaa12818c29607655b0

  • SHA256

    edbc8c0273fe91bd2217bed8087f2718d5b429623c802ce96dbf68f9a4998010

  • SHA512

    cf568aa872625fa5eafb9abfcd824899118adaa01b8dcb263888b9367b7b9dddf8041e0d2e65e6a5fd3701c8281b3b59c5da13d598836a258bd1cf06c9094651

  • SSDEEP

    1536:qiUQf1OdalnaYJy8PNigFfaGZp78lbcuZ/+J07:qiUmOEdvTNVfaGZp78lwuUW7

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0797ae480b07fb4e00b16482cf5435cb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0797ae480b07fb4e00b16482cf5435cb_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Users\Admin\AppData\Local\Temp\0797ae480b07fb4e00b16482cf5435cb_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\0797ae480b07fb4e00b16482cf5435cb_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3168
      • C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
        "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" DEL:C:\Users\Admin\AppData\Local\Temp\0797ae480b07fb4e00b16482cf5435cb_JaffaCakes118.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
          "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2936
          • C:\Program Files (x86)\Common Files\Java\Java Update\jusched .exe
            "C:\Program Files (x86)\Common Files\Java\Java Update\jusched .exe" "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
            5⤵
              PID:1572

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

      Filesize

      144KB

      MD5

      4be2f12dbc5fc87e7f0542c1668b954b

      SHA1

      4f98042231f55b3ff5dd013c80437a2198968cd4

      SHA256

      048e099fb5a336bee01a8d92eeab089e444ef053946fafe4f1b93cc1de2473f6

      SHA512

      92c069d2c03440398d2c867f4c09c5059c7b21837b309892441cce7f448b48116cd4516fd8b032145e62016721dee2a6befe64a219271826bce71938fd696cd0

    • memory/2936-28-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/3168-2-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/3168-4-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/3168-21-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB