Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 21:29

General

  • Target

    0f98374016e2f3a77034ecf068624e89_JaffaCakes118.exe

  • Size

    124KB

  • MD5

    0f98374016e2f3a77034ecf068624e89

  • SHA1

    6c363894525531dfd2135d648cbd18341c0e0c53

  • SHA256

    3958f341474249b0fc1772c46bf4b2a8f6531bea26caceb44ec5c6c7aa1619cb

  • SHA512

    2d6e5e928a23767203c86a01e9cc9bad99e430d57175a71b7743deccd2b665dfa5e88e7614825709b446b107edef74fdb2cc5fcb9377723799b3c0e125459756

  • SSDEEP

    3072:yLk395hYXJTS4Z+H22Zip6dmDHgG2ojdotyeILc:yQqI4ITsp6dAT2ojdoIeILc

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f98374016e2f3a77034ecf068624e89_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0f98374016e2f3a77034ecf068624e89_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:412
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:980
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s /u "C:\Users\Admin\AppData\Local\Temp\iWinGamesHookIE.dll"
        3⤵
          PID:380
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s /u "C:\Users\Admin\AppData\Local\Temp\iWinInfo.dll"
          3⤵
            PID:3436

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nsv87DE.tmp\GameuxInstallHelper.dll

        Filesize

        94KB

        MD5

        4d3ac88054df63fc810427bdaa96c458

        SHA1

        e4d554e03ba91f6b53a2a80253b339f56e303c94

        SHA256

        b07ffcd0af80f6b9fba09abe816ba2f0ff0d336639f1768fc317291bc635ece6

        SHA512

        d4732ad89bbb19b316dff1b9c534acf98bb985c89d1295f08e24b21531123426500b3712979dda2f0e941a5969c0cbca15bbd52f6c167653f96a494a6677ca54

      • C:\Users\Admin\AppData\Local\Temp\nsv87DE.tmp\System.dll

        Filesize

        11KB

        MD5

        00a0194c20ee912257df53bfe258ee4a

        SHA1

        d7b4e319bc5119024690dc8230b9cc919b1b86b2

        SHA256

        dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

        SHA512

        3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

      • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

        Filesize

        124KB

        MD5

        0f98374016e2f3a77034ecf068624e89

        SHA1

        6c363894525531dfd2135d648cbd18341c0e0c53

        SHA256

        3958f341474249b0fc1772c46bf4b2a8f6531bea26caceb44ec5c6c7aa1619cb

        SHA512

        2d6e5e928a23767203c86a01e9cc9bad99e430d57175a71b7743deccd2b665dfa5e88e7614825709b446b107edef74fdb2cc5fcb9377723799b3c0e125459756