Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 22:08

General

  • Target

    6923456e8ab23bb8dc91f1d9049edeed_JaffaCakes118.exe

  • Size

    438KB

  • MD5

    6923456e8ab23bb8dc91f1d9049edeed

  • SHA1

    b0282a956b89377f07765d2b2eb74b132975ee69

  • SHA256

    8331e12ee8d73d21398f2d3013486398fe244002d15a024a3be740c6a2c481ee

  • SHA512

    aaa4de9743e0b40910c3ec118d1c28f3688a382cf001d159ceed578ed30895e4124796164ac78bfd48826d8b11157152e1eb26d89e5b30ba8dc84fa68c30a93f

  • SSDEEP

    12288:nM255nI71TVaR0GLNCDN3XpeTWnv7zxjIQkYz0q00/:M2kTiJCFZd6QkTq00

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3376
      • C:\Users\Admin\AppData\Local\Temp\6923456e8ab23bb8dc91f1d9049edeed_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\6923456e8ab23bb8dc91f1d9049edeed_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: RenamesItself
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3776
        • C:\Users\Admin\AppData\Local\Temp\CxCQWBMUmC.exe
          "C:\Users\Admin\AppData\Local\Temp\CxCQWBMUmC.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3636

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\CXhrjhuXpE.dll

      Filesize

      389KB

      MD5

      e2e6172d0baf39177d3db0a8f606606c

      SHA1

      6ba61439fe99adfa4af1aef1113eea8a464be227

      SHA256

      95c0e9d86924d9da6f283089fffd1e73344b2b6d8df6c2bcae215104fd200c3e

      SHA512

      e3618830fb5d604c8c6116657aaae3b3ee8ca2f19687f10b378325042e6b6226f958986fc5931b2581512fe7a6faeb9080872346ac7ada981b77105bd9d1c0d9

    • C:\Users\Admin\AppData\Local\Temp\CxCQWBMUmC.exe

      Filesize

      438KB

      MD5

      6923456e8ab23bb8dc91f1d9049edeed

      SHA1

      b0282a956b89377f07765d2b2eb74b132975ee69

      SHA256

      8331e12ee8d73d21398f2d3013486398fe244002d15a024a3be740c6a2c481ee

      SHA512

      aaa4de9743e0b40910c3ec118d1c28f3688a382cf001d159ceed578ed30895e4124796164ac78bfd48826d8b11157152e1eb26d89e5b30ba8dc84fa68c30a93f

    • memory/3636-13-0x0000000000400000-0x0000000000550000-memory.dmp

      Filesize

      1.3MB

    • memory/3636-14-0x0000000000400000-0x0000000000550000-memory.dmp

      Filesize

      1.3MB

    • memory/3636-18-0x0000000000400000-0x0000000000550000-memory.dmp

      Filesize

      1.3MB

    • memory/3776-0-0x0000000002370000-0x00000000023DB000-memory.dmp

      Filesize

      428KB

    • memory/3776-1-0x0000000000400000-0x0000000000474000-memory.dmp

      Filesize

      464KB

    • memory/3776-16-0x0000000000400000-0x0000000000550000-memory.dmp

      Filesize

      1.3MB

    • memory/3776-17-0x0000000000400000-0x0000000000474000-memory.dmp

      Filesize

      464KB