Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 09:09

General

  • Target

    21cf2423cc48b1dd2496bc34b435a932_JaffaCakes118.exe

  • Size

    797KB

  • MD5

    21cf2423cc48b1dd2496bc34b435a932

  • SHA1

    639257ece6992db28a2962a8bde071507ebfce55

  • SHA256

    ff3b095fdcb45b12a60ba1c914578da6233a047e1111d53c7640db20e9e208c7

  • SHA512

    0cb636f041c82bff1b6925f740a2086fd885de12751d15a6bd98daa7d088be46cc5fc6fec650bbf36fd36eeee58acdc0360be405c6158f5137a2a328cd05f0e0

  • SSDEEP

    12288:Hj/kT1PyjoPiAYIvXGtU8VqDPvlZSfpjy/LuYD3Njb0ZM9+LNDiz6vrEFERxv951:D89b7CCuUCjcA6cLvW

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21cf2423cc48b1dd2496bc34b435a932_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\21cf2423cc48b1dd2496bc34b435a932_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in Windows directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\ProgramData\tdkhzswc.exe
      "C:\ProgramData\tdkhzswc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\tdkhzswc.exe

    Filesize

    797KB

    MD5

    21cf2423cc48b1dd2496bc34b435a932

    SHA1

    639257ece6992db28a2962a8bde071507ebfce55

    SHA256

    ff3b095fdcb45b12a60ba1c914578da6233a047e1111d53c7640db20e9e208c7

    SHA512

    0cb636f041c82bff1b6925f740a2086fd885de12751d15a6bd98daa7d088be46cc5fc6fec650bbf36fd36eeee58acdc0360be405c6158f5137a2a328cd05f0e0

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe

    Filesize

    34KB

    MD5

    e118330b4629b12368d91b9df6488be0

    SHA1

    ce90218c7e3b90df2a3409ec253048bb6472c2fd

    SHA256

    3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

    SHA512

    ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

  • memory/1848-0-0x00000000750C2000-0x00000000750C3000-memory.dmp

    Filesize

    4KB

  • memory/1848-1-0x00000000750C0000-0x0000000075671000-memory.dmp

    Filesize

    5.7MB

  • memory/1848-2-0x00000000750C0000-0x0000000075671000-memory.dmp

    Filesize

    5.7MB

  • memory/1848-18-0x00000000750C0000-0x0000000075671000-memory.dmp

    Filesize

    5.7MB

  • memory/3956-20-0x00000000750C0000-0x0000000075671000-memory.dmp

    Filesize

    5.7MB

  • memory/3956-19-0x00000000750C0000-0x0000000075671000-memory.dmp

    Filesize

    5.7MB

  • memory/3956-23-0x00000000750C0000-0x0000000075671000-memory.dmp

    Filesize

    5.7MB

  • memory/3956-24-0x00000000750C0000-0x0000000075671000-memory.dmp

    Filesize

    5.7MB

  • memory/3956-25-0x00000000750C0000-0x0000000075671000-memory.dmp

    Filesize

    5.7MB