Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
3d093e302bcf432e1d6c0033491eff77_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3d093e302bcf432e1d6c0033491eff77_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3d093e302bcf432e1d6c0033491eff77_JaffaCakes118.exe
-
Size
204KB
-
MD5
3d093e302bcf432e1d6c0033491eff77
-
SHA1
b0d0d6738ef0bc4f7bd274845e626f45a0ed740d
-
SHA256
95b3f8d653fabb80740070c98b0aecad2fe0f2814380afdc58b99e5a03c0a97f
-
SHA512
f057900a8677a88df3c49e1526c81afb0405f637de9a823d3f346657e43b8a8c0279b1590648ece9eacf0667b8cf0c4ef3906e9ba438d5e88754f6915125fb04
-
SSDEEP
6144:UNIiRHpm80bjIskJBZ7h/2WAnx9kLSbtAkG+bdHeMu:WTHtLVh/2WKxGWRRG+bd+Mu
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 3d093e302bcf432e1d6c0033491eff77_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation 3d093e302bcf432e1d6c0033491eff77_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3628 ipconfig.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2628 3d093e302bcf432e1d6c0033491eff77_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2628 wrote to memory of 3628 2628 3d093e302bcf432e1d6c0033491eff77_JaffaCakes118.exe 85 PID 2628 wrote to memory of 3628 2628 3d093e302bcf432e1d6c0033491eff77_JaffaCakes118.exe 85 PID 2628 wrote to memory of 3628 2628 3d093e302bcf432e1d6c0033491eff77_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d093e302bcf432e1d6c0033491eff77_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3d093e302bcf432e1d6c0033491eff77_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /flushdns2⤵
- Gathers network information
PID:3628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89B
MD52bd83f0dd1740fff26d071dcdd59af56
SHA1221e9e64a79255053a9e4da65957a7bdd6bc045b
SHA25670a676e21716581858de2753ea5eec8befe6741ed299216f65a13c3853805c05
SHA512fe632b63b8b850cc83f0eb2a114de60693ec0dd8b62fe8f0938b42526557889f48357da0ca3bb06bed1ad68562280023a69b54d93cff8b7266bb8ebb63ac903c