Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 02:18

General

  • Target

    3fcdda9e4d306fe0369d5f2a3e38025b_JaffaCakes118.exe

  • Size

    248KB

  • MD5

    3fcdda9e4d306fe0369d5f2a3e38025b

  • SHA1

    3edf4fa6404fddb697972fda88fa7969578d9ca9

  • SHA256

    57b0a40238c46fbc325d2a7e8d21d42677e133a475df4873067e9b6f5baeff43

  • SHA512

    5035f62e24fa2d6e172d2fcba8a877b964aa06efeb68a5190b2a7413cfd721c3a44e2350ee05036ebf055ac06aa0f193841a2441cabe484389dd16c900234eed

  • SSDEEP

    6144:TweVQEyyUf9dgAVRKlqBiErIsKnPmb7/jWal+FfAje+5/RxoOsutOSD/uP39RWyJ:TwRyUf9DRKlqgErIsKnPmb7/jWa1e+5T

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3fcdda9e4d306fe0369d5f2a3e38025b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3fcdda9e4d306fe0369d5f2a3e38025b_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Users\Admin\beeab.exe
      "C:\Users\Admin\beeab.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\beeab.exe

    Filesize

    248KB

    MD5

    e47502800c9677dfe53f4b83da421ce4

    SHA1

    913739b5734829f97fb673fdb565479330ba3be3

    SHA256

    8d9f3fc254cedc8142b30d9f246c84c24d07123aa7f541d7b6b26d5cb5dec968

    SHA512

    ba43b5cb91d020f72cc6a95150f9af8d3f22fce1137ac11a31e64afd4ecfbbba19514cdddabc5e06ecf4d4bbc06c495c163b70c9f274e6a84a2ecb1f7ba42d3f