Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 17:40
Behavioral task
behavioral1
Sample
2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe
-
Size
474KB
-
MD5
2d3df43464ecfe0c82902410267ab158
-
SHA1
6eb51d7b8aa89dc4198b521bfba1bd3120f32513
-
SHA256
bc9edcc989273ea2343f5b565f6ac28de3c0cb6ea9dc2fd4ca3d57881e8e8fb5
-
SHA512
ca64b476fe1b8572e687f487a722dde38637f236a0c622b6f087873f770b428c598caae7328e2136685bf5feff77f9caa220a0eacf9a9c02e9e2cdfe7dabfbf8
-
SSDEEP
6144:5SrUuHX7jBQj61e0Jz6H119A1/DXg/SwxXUZRQORva4:5mpL1Qj61e0ASDXg/S+EZRLX
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4928-0-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/4928-1-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/4928-2-0x0000000000400000-0x0000000000477000-memory.dmp upx -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\u: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\e: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\g: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\o: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\n: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\q: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\r: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\t: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\v: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\w: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\y: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\z: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\i: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\l: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\p: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\m: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\s: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\x: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\h: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\j: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe File opened (read-only) \??\k: 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2d3df43464ecfe0c82902410267ab158_JaffaCakes118.exe