Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 07:30
Static task
static1
Behavioral task
behavioral1
Sample
48cf7f7b4180b1c4fb3ac3e149917130_JaffaCakes118.lnk
Resource
win7-20240705-en
General
-
Target
48cf7f7b4180b1c4fb3ac3e149917130_JaffaCakes118.lnk
-
Size
1.2MB
-
MD5
48cf7f7b4180b1c4fb3ac3e149917130
-
SHA1
4186f3b6bd8225ede814047952e1e0f0f450faf7
-
SHA256
cff5ed4de201256678c7c068c1dbda5c47f4b322b618981693b1fd07a0ea7e68
-
SHA512
59c5cef7739e1ee8d5607f5d8cc0c53690bbfe72186cc313b038b43bd14a7bcc5662fe9b3230150175df284d2629ba979033eb01288deb76e8fbf7a154057b85
-
SSDEEP
24576:X42VC/nwI01fjjftIf2T6amcOZiZ1t+vk3gY1J56cVoKt8hyeu2:XXQ/nfUjftIuT/mW1t0k3gY1ZtYyen
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation cmd.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1268 wrote to memory of 1624 1268 cmd.exe 84 PID 1268 wrote to memory of 1624 1268 cmd.exe 84 PID 1624 wrote to memory of 452 1624 cmd.exe 85 PID 1624 wrote to memory of 452 1624 cmd.exe 85 PID 1624 wrote to memory of 4748 1624 cmd.exe 86 PID 1624 wrote to memory of 4748 1624 cmd.exe 86 PID 1624 wrote to memory of 3020 1624 cmd.exe 88 PID 1624 wrote to memory of 3020 1624 cmd.exe 88
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\48cf7f7b4180b1c4fb3ac3e149917130_JaffaCakes118.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&move "JointAccountDCS.pdf.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "END2">"C:\Users\Admin\AppData\Local\Temp\0.js"&wscript "C:\Users\Admin\AppData\Local\Temp\0.js"2⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""3⤵PID:452
-
-
C:\Windows\system32\find.exefind "END2"3⤵PID:4748
-
-
C:\Windows\system32\wscript.exewscript "C:\Users\Admin\AppData\Local\Temp\0.js"3⤵PID:3020
-
-