Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 10:57

General

  • Target

    674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe

  • Size

    148KB

  • MD5

    674c9c3ab659c4eead1f503ae186f0ad

  • SHA1

    9ab5881b142d73709318f1fd5fcc1ada88f4ee82

  • SHA256

    242749bb831e7f859b93bbe902fcb91ffb04a8db97a210d54a9bd8f1174036a4

  • SHA512

    518d8cd9c06cb6157763a7cf95293283f28fc8216efe514409203148077b25eb462fd393b954ca667e82fee5ca31c59eb5a96165cf531c7aa3040b01328d54d9

  • SSDEEP

    3072:gdo+kgRs59j/pvkqBBac+RAGq1bg7Yfgst6OzOS79pgRZkhQJAOA29E5j4oQC6:OoBbj/pvkqBBac+RAGq1bZHtrzOS77kI

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Users\Admin\sbtaew.exe
      "C:\Users\Admin\sbtaew.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\sbtaew.exe

    Filesize

    148KB

    MD5

    3bfc0288e92c537989fe531683dd9f70

    SHA1

    69f1e0e444c28e7074f2650f6b58e8a8e1b7d43c

    SHA256

    b8d41eb9f7876118e4385c1a67e0f7c099f28680838f75d6428f4422edc4380a

    SHA512

    152c47d3ed580c1521e172ffae2a04377c4beea3ea4613a5f627b5e94eb6c33afe0683b72c5f5cdf12f5d5d750ca4da11483e1c50e961a870227c4581d1b64a3