Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 03:12
Static task
static1
Behavioral task
behavioral1
Sample
2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe
-
Size
567KB
-
MD5
2ac90ccead8da159233fe4096f5ff0c8
-
SHA1
c5ecff37dc5dec066e6969d905204c60144e4b2a
-
SHA256
73ad76933a6f55a53dcbaecbace8457f0dd095ce78f75e4fa70b161664a9aaa5
-
SHA512
a3f148613241fd93616fd012ff2148a86fdbb4f9483da77905997292609429323d00714ffc84f475a8e8cb7b47ed4224f162030a08eca6a2bc109a087cd22eff
-
SSDEEP
12288:NJYIlIUr41owTtmHgYPW82ImgHTas8NrWr4YYARWP/yYaI1xCLo6yvw:NZlaTtmHJPWBImCTar84XH7x1s8Zo
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\Control Panel\International\Geo\Nation 2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3260 setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4892 wrote to memory of 3260 4892 2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe 85 PID 4892 wrote to memory of 3260 4892 2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe 85 PID 4892 wrote to memory of 3260 4892 2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"2⤵
- Executes dropped EXE
PID:3260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD52bbfe6a0dfc9b9038b82d7183bf9c79b
SHA12a167441b84ab72dfc68696b0cfe5cc0209d3553
SHA256a090f0a02ee737a47f5bcc7c8a7e30b0328f6448d05ae57101563a29693fdb28
SHA51230c204243a5b8db8ecb6c8bdd32508129ed161ae0c515e677712845ea709d0f78f5093309f830eff5eaf7287fa9220565005e02e7fe7aa507241ac53f2ef9fe9
-
Filesize
1KB
MD58f37f672ca6923a9cc3b2d0f7007f6dd
SHA14be4c36139fbebdb0d5dc0593414aef850251a11
SHA25693b5d88603d4aae07ea4d135b0b2de3efee8137221c8bcb64a28bee8e300dac7
SHA512858f31a6be34f7f7ea849c5a805fb9b0f23cb5bdc2e710ed0bc72dfbe2ecd539ed21c3603038dd969232d4ce97e23f21855ab81a3cfac8a5d3640253811aabd9
-
Filesize
2KB
MD5119b482883e355b1489628f33ee9ef88
SHA1aff3ddbd68ff41d116af1b64558b354b8d1c3dca
SHA25683cea594ac7bb6b1fc78bfce814b129189309882ff0fe760ca6bba103292d299
SHA512c4eaed2b17d69189c9514646fdfeed4d4e8190f992f1c13375224fc00ac2a99b7850de6eaf0f2b3ebb35b251f74b6d859b1052a06b5900d0fbef25c84f6c0a20
-
Filesize
835KB
MD536a25ebfbeefe809b692a48853ad0721
SHA11baf55b5a63d68be8b84c0f36555fd6207ee41dd
SHA25685fdb70a131d0cc7fa4b5d713dd72c39802bdd0cf0b7bb6f2d574097a5bd3ac3
SHA512574d992e87ff5deff615ca56e8ef63616d6d44cf121e68dd72e2ee7823e1a31f9a882261068aab1c7fcdf2f1dd6cc7aa653f7c6f9096893dbf43b41555c5c1ef
-
Filesize
6KB
MD5a7bea13818443198e2469591f774d235
SHA194ea8ffcfaca9abab13d00d1df0a73efa32b3edf
SHA256e394da7750f17ff4bb99a8189de78860b4e2ed95d5be653348c3c24ac347a0ee
SHA5129fabf260a169dabbb37ca922fcf447a0b6b2241e54b52b44db34b6b91153a61273471c3be1ed7d77baa2258fb5f2f790b234819f600a585e41df4b0f0a0971ea