Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 12:34
Static task
static1
Behavioral task
behavioral1
Sample
34bd47ca57b4c86fd547fc9ede2d1202_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
34bd47ca57b4c86fd547fc9ede2d1202_JaffaCakes118.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
General
-
Target
34bd47ca57b4c86fd547fc9ede2d1202_JaffaCakes118.exe
-
Size
83KB
-
MD5
34bd47ca57b4c86fd547fc9ede2d1202
-
SHA1
bb447a11a79915055cb1b41a591e85c3f6bc98d0
-
SHA256
964ef32415b1fb5f83c0e554b714724f0851c4bbf26dbd1f356f64fdfb02614a
-
SHA512
57b563c1c9ebae3538614c293a48633d928a799c92f1129cee5d0c10efe7be4b26f4f9b3efc8b03f9a6e63967ab50b059e7d9bba984f712e46f874635a23cc89
-
SSDEEP
1536:mEkjY1zy214Qay0DGkJ7qAELVigJk2R2cpIO6/9ZnoD2/DQL:NkjAJ4dDGkJ+AI0MRf+O6VZn/s
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1372 Au_.exe -
Loads dropped DLL 2 IoCs
pid Process 1372 Au_.exe 1372 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023477-4.dat nsis_installer_1 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5048 wrote to memory of 1372 5048 34bd47ca57b4c86fd547fc9ede2d1202_JaffaCakes118.exe 83 PID 5048 wrote to memory of 1372 5048 34bd47ca57b4c86fd547fc9ede2d1202_JaffaCakes118.exe 83 PID 5048 wrote to memory of 1372 5048 34bd47ca57b4c86fd547fc9ede2d1202_JaffaCakes118.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\34bd47ca57b4c86fd547fc9ede2d1202_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\34bd47ca57b4c86fd547fc9ede2d1202_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5d765c492c21689e3d9d61634371fd861
SHA1ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA256551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
SHA5129919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
-
Filesize
10KB
MD5fe24766ba314f620d57d0cf7339103c0
SHA18641545f03f03ff07485d6ec4d7b41cbb898c269
SHA256802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
SHA51260d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
-
Filesize
619B
MD5d08a4b5a2131aa540f8df25122b1f3cb
SHA1d5da25bb5fb09df61dad12a2647c36921b63acd4
SHA2569c8c2072087c2da6602ad23031cda44ec61db299d6aa154973dffd7825abfe5d
SHA5121a053c63be6d7bf087fbec669ea1e394e4880c702e8705749d4dc70e291515751e6b9b8cb7ef6e844ec898c4ae00d17341307280ae717d6ff64b58c9ccf0db6c
-
Filesize
83KB
MD534bd47ca57b4c86fd547fc9ede2d1202
SHA1bb447a11a79915055cb1b41a591e85c3f6bc98d0
SHA256964ef32415b1fb5f83c0e554b714724f0851c4bbf26dbd1f356f64fdfb02614a
SHA51257b563c1c9ebae3538614c293a48633d928a799c92f1129cee5d0c10efe7be4b26f4f9b3efc8b03f9a6e63967ab50b059e7d9bba984f712e46f874635a23cc89