Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 05:52

General

  • Target

    5ab5d439876f093f5fd7a4f2b015b4be_JaffaCakes118.exe

  • Size

    670KB

  • MD5

    5ab5d439876f093f5fd7a4f2b015b4be

  • SHA1

    2710bb80f6c8d5eafcde9914743d2f217299eb2f

  • SHA256

    d0f5829601cfccf94cd693c813f720b2c62a1d11a0c5de6e544a7cdac5251b18

  • SHA512

    a2cc472a017bf70e112b99ab7b0b40144b693beb4e3e438113d15dbd10af149b17c9d2a21af0a750b2d1a81070489b4a94b9a04ab5528b8618b4556efca5c910

  • SSDEEP

    12288:3Bi3pbKz9v0gBkqAzf+92bl06KZSnsPMx2VmXVmV+Xxde6dBX:3BiFKzffTMbl06sw2VmEV+2q1

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ab5d439876f093f5fd7a4f2b015b4be_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5ab5d439876f093f5fd7a4f2b015b4be_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    PID:3332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsl9452.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    fa5beae80dba254fb6c21b58265f5310

    SHA1

    f2f776611dbbb157b151aa744a7e0be1d4b8c079

    SHA256

    34b8a2130729064ca2f9b3b8e6f90d883d84662156b648a4eeccefefc3473269

    SHA512

    7c74b9e9f1ff0665ffd6fcf76fca462d9f4fbd7c4a215bc67b419497ef4c3cb9cede6c5b0803cabb316bc5391c4c6f0d578d36e1094b8ed326b140f8e272b538

  • C:\Users\Admin\AppData\Local\Temp\nsl9452.tmp\ioSpecial.ini

    Filesize

    591B

    MD5

    a023096cd84fe90fe37986f88a579c45

    SHA1

    9e0f0be727b86f5edf12d66ef363033036e8c691

    SHA256

    01abc87e695a85b52b85ddfed1a786d0a8d5c67790d7165822067817dee0afec

    SHA512

    5c102031a37b63127050ee549ee56e3481903e42c0b6374cfc897e6d5a2d3acca828c8c2e2bb44080395b0e7c54526687deb5971aa3af9da001ea34b335329fc