Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 23:52

General

  • Target

    36e75bcdd349e9aac5f525644a31f1d3_JaffaCakes118.exe

  • Size

    794KB

  • MD5

    36e75bcdd349e9aac5f525644a31f1d3

  • SHA1

    b8f360578b1efe23437f38b46734b354eb2d11d6

  • SHA256

    4d46e581b79b26dada9734336c957bd6e6ad3e216db81b3d513beb8589294e7d

  • SHA512

    a325dc4e399d3b24522a0a2750e763d846c5a4260b45e93921a9912a0964276e9c779a5388356fed5201c4db8dc91ad09a1312419370d323d47b342019c5ded9

  • SSDEEP

    12288:cGehnWS1CJ0bhX0iItc6c/9Z23iLH22qQ3QZlg0:cxEGC4ps8FZ23ucQ3QE0

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36e75bcdd349e9aac5f525644a31f1d3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\36e75bcdd349e9aac5f525644a31f1d3_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Windows\SysWOW64\CRYPTED.EXE
      "C:\Windows\system32\CRYPTED.EXE"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3496
      • C:\Windows\SysWOW64\CRYPTED.exe
        3⤵
        • Executes dropped EXE
        PID:3608
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 228
          4⤵
          • Program crash
          PID:3832
    • C:\Windows\SysWOW64\Y!BEEP.EXE
      "C:\Windows\system32\Y!BEEP.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3160
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3608 -ip 3608
    1⤵
      PID:668

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\CRYPTED.EXE

      Filesize

      155KB

      MD5

      849e5da7bbe21eae56d87e387c7541e9

      SHA1

      ae8fab54d2fc19a7716465cbfc90806a26e66e8e

      SHA256

      598ee7b1d6d4ffaba6ef3df8d9c47b812667fcdb47feb5a0e877d68ff2109d84

      SHA512

      7625c35a24e6d3bfde3f6ab04136feccc6adc241e4254e47ff6bbf63a46d03e100a8868d2c3b8b562e8e5b958bcf88846eefe95b484a4d14eab9c3126422876d

    • C:\Windows\SysWOW64\Y!BEEP.EXE

      Filesize

      280KB

      MD5

      7b90ce2a72663280e6f25dd5b3ac0462

      SHA1

      f05f170d68f248ee0add768dd6b93d03b20892cd

      SHA256

      9de6f625705a523609ac020ff9848805065d81eda5445f9880e60dd4126bfc44

      SHA512

      b7aba0a1072c800206f7d5a769cdd28f893f63be1f67815b2fc13a5aaa459e9a48828004d7c4470bb000cda2185c8466911dda1d55066d27193f99baab7f13b9

    • memory/2476-0-0x0000000002360000-0x0000000002361000-memory.dmp

      Filesize

      4KB

    • memory/2476-23-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB

    • memory/3608-34-0x0000000000400000-0x000000000040E76C-memory.dmp

      Filesize

      57KB

    • memory/3608-33-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB

    • memory/3608-31-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB

    • memory/3608-32-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB

    • memory/3608-28-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB