Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 23:03

General

  • Target

    694f79ff19ff797846458adafaed4a05_JaffaCakes118.exe

  • Size

    160KB

  • MD5

    694f79ff19ff797846458adafaed4a05

  • SHA1

    30ffdbef5a52da4f83f8f00e43a5a44b9aa4b633

  • SHA256

    4653926001769e6074c9288b50fa42b1c10423d224a462422023e780b35dfb1a

  • SHA512

    a067fca98dcde7445ac31172272fd1fda369d937f2455bf28a39375aa2d40498bad6503afe462e0f0cd9057447ea09694b6f049ab84c0b1b6a44378295c7ce7b

  • SSDEEP

    3072:i2ePa6GnZQ7NEEhIjIfUyT5GFySsckDBA3SMrLi+RdGsxtqt:Ey6Gnq5Qjg5msbcSK2oEy

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\694f79ff19ff797846458adafaed4a05_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\694f79ff19ff797846458adafaed4a05_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3656
    • C:\Users\Admin\AppData\Local\Temp\JavaUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\JavaUpdate.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1780
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 492
        3⤵
        • Program crash
        PID:2772
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1780 -ip 1780
    1⤵
      PID:5004

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\JavaUpdate.exe

      Filesize

      160KB

      MD5

      694f79ff19ff797846458adafaed4a05

      SHA1

      30ffdbef5a52da4f83f8f00e43a5a44b9aa4b633

      SHA256

      4653926001769e6074c9288b50fa42b1c10423d224a462422023e780b35dfb1a

      SHA512

      a067fca98dcde7445ac31172272fd1fda369d937f2455bf28a39375aa2d40498bad6503afe462e0f0cd9057447ea09694b6f049ab84c0b1b6a44378295c7ce7b

    • memory/1780-23-0x0000000000400000-0x0000000000479000-memory.dmp

      Filesize

      484KB

    • memory/1780-22-0x0000000000400000-0x0000000000479000-memory.dmp

      Filesize

      484KB

    • memory/1780-21-0x0000000000400000-0x0000000000479000-memory.dmp

      Filesize

      484KB

    • memory/3656-3-0x0000000000A80000-0x0000000000A81000-memory.dmp

      Filesize

      4KB

    • memory/3656-6-0x0000000000400000-0x0000000000479000-memory.dmp

      Filesize

      484KB

    • memory/3656-1-0x0000000000400000-0x0000000000479000-memory.dmp

      Filesize

      484KB

    • memory/3656-0-0x0000000000400000-0x0000000000479000-memory.dmp

      Filesize

      484KB

    • memory/3656-4-0x0000000000402000-0x0000000000477000-memory.dmp

      Filesize

      468KB

    • memory/3656-20-0x0000000000402000-0x0000000000477000-memory.dmp

      Filesize

      468KB

    • memory/3656-19-0x0000000000A50000-0x0000000000A73000-memory.dmp

      Filesize

      140KB

    • memory/3656-18-0x0000000000400000-0x0000000000479000-memory.dmp

      Filesize

      484KB

    • memory/3656-2-0x0000000000A50000-0x0000000000A73000-memory.dmp

      Filesize

      140KB