Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2024, 08:32

General

  • Target

    27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe

  • Size

    60KB

  • MD5

    27e89d64fdb9428c8ca148563e8f93f2

  • SHA1

    00cb053ed929741dddcc2e29590cd1c979b62c13

  • SHA256

    ecf453178861bcf7883eee354d2bd11e6ab4626d3059bad93d114ecd55d658f2

  • SHA512

    b41daa3be5979ddd462bf39d0d1ee02955d3ad483b8054e669e6c241254033bb8843caac126893aace61fb3623f6d5cf7170f1070e53b2498012deec31b10f12

  • SSDEEP

    1536:V3cpyORJLuB4P4AJJv4Romu/v4ptqrmX+lE8QG+G:V3c1fP4AJJv45Slwa

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 9 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 12 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1840
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c move "C:\Users\Admin\AppData\Local\Temp\Internat Explorar" "C:\Users\Public\Desktop\Internat Explorar"
      2⤵
        PID:3436
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c attrib "C:\Users\Public\Desktop\Internat Explorar" +s
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3440
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Public\Desktop\Internat Explorar" +s
          3⤵
          • Views/modifies file attributes
          PID:3152
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\temp_tmp.bat" "
        2⤵
          PID:2964

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nsq8946.tmp\AccessControl.dll

        Filesize

        10KB

        MD5

        055f4f9260e07fc83f71877cbb7f4fad

        SHA1

        a245131af1a182de99bd74af9ff1fab17977a72f

        SHA256

        4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc

        SHA512

        a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26

      • C:\Users\Admin\AppData\Local\Temp\nsq8946.tmp\System.dll

        Filesize

        11KB

        MD5

        00a0194c20ee912257df53bfe258ee4a

        SHA1

        d7b4e319bc5119024690dc8230b9cc919b1b86b2

        SHA256

        dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

        SHA512

        3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

      • C:\Users\Admin\AppData\Local\Temp\temp_tmp.bat

        Filesize

        214B

        MD5

        4262ace1550136418d1f2828bc2650d6

        SHA1

        3284abfb6fc572ddacc5b1c4a5b1d6ece4ff8848

        SHA256

        bc5f323f53443ff48b73d2886434e166fd8c517af223116d0f6c3cbb3cec7e8c

        SHA512

        b2fd4e4f1e73b3f1abc5caba005dce7fb011d92db502888c6fecb18b1598467598839140c159e456ccb3915e1ba7e98418e7fbedbad7716143a7bc078f1027d6

      • C:\Users\Public\Desktop\ÌÔ ±¦ Íø ¹º.lnk

        Filesize

        1010B

        MD5

        0241624317d179d69afaf8bdd85e6603

        SHA1

        293e70e2d3ef82aeaafb1edf0f4811290c8e10e6

        SHA256

        3808e5ceae259f656b45361840daecff6c0e753a2e03cc490d7ce550ffb8b56f

        SHA512

        806b249b8dc3d6865b96b5a63f1e0b74e2b783a2d58151ceadf5d3b53f66da666300bbde1c8c48a6b26d8c0e98ed60f4b50429b9770b251a34e91082dc2e0aab