Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 07:30

General

  • Target

    48cf7f7b4180b1c4fb3ac3e149917130_JaffaCakes118.lnk

  • Size

    1.2MB

  • MD5

    48cf7f7b4180b1c4fb3ac3e149917130

  • SHA1

    4186f3b6bd8225ede814047952e1e0f0f450faf7

  • SHA256

    cff5ed4de201256678c7c068c1dbda5c47f4b322b618981693b1fd07a0ea7e68

  • SHA512

    59c5cef7739e1ee8d5607f5d8cc0c53690bbfe72186cc313b038b43bd14a7bcc5662fe9b3230150175df284d2629ba979033eb01288deb76e8fbf7a154057b85

  • SSDEEP

    24576:X42VC/nwI01fjjftIf2T6amcOZiZ1t+vk3gY1J56cVoKt8hyeu2:XXQ/nfUjftIuT/mW1t0k3gY1ZtYyen

Malware Config

Signatures

  • Evilnum

    A malware family with multiple components distributed through LNK files.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\48cf7f7b4180b1c4fb3ac3e149917130_JaffaCakes118.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&move "JointAccountDCS.pdf.lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "END2">"C:\Users\Admin\AppData\Local\Temp\0.js"&wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""
        3⤵
          PID:452
        • C:\Windows\system32\find.exe
          find "END2"
          3⤵
            PID:4748
          • C:\Windows\system32\wscript.exe
            wscript "C:\Users\Admin\AppData\Local\Temp\0.js"
            3⤵
              PID:3020

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads