Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

14ce222f58...18.exe

windows7-x64

10

14ce222f58...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2024, 05:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    14ce222f58a5252d8a8edcc01f7cf9d7_JaffaCakes118.exe

  • Size

    64KB

  • MD5

    14ce222f58a5252d8a8edcc01f7cf9d7

  • SHA1

    5d1d4a7f3b0e1a0041b193e562f78cf9eb467d27

  • SHA256

    102dfd59166c4c43e467ce0641f1d3046dc353d195c08d964cad84b1b2ba67e9

  • SHA512

    195ae14ce40677ea8fc57361067aa8797a7c3736017661b23d9348e0c2f19d96668922336130d9cf454883e9356819975933d854b5df8c945f9fb948b16fb2e0

  • SSDEEP

    768:A/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLCl:ARsvcdcQjosnvnZ6LQ1Ee

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14ce222f58a5252d8a8edcc01f7cf9d7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\14ce222f58a5252d8a8edcc01f7cf9d7_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Program Files (x86)\Java\jre-09\bin\jusched.exe
      "C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Java\jre-09\bin\jusched.exe
    Filesize

    64KB

    MD5

    c7e949ba6281728d20a654283a0b9c46

    SHA1

    b90fb066ecb23e4113310a2978934415620270f8

    SHA256

    9e60f2f12452d0f3c3afb923456db13974e080bb810df513623b6ee35b615e38

    SHA512

    2f7bd514392edb433f1ce4a3512bcfc9010ed39eca8f4e896ce5071bdfa2f85cd13907784fa216fba3eae83063855358dcbb89789e3e3fe569dd0ff63f44587d

    Download Submit

  • memory/3100-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

    Download

  • memory/3100-11-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

    Download

  • memory/3320-12-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

    Download