Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 10:23

General

  • Target

    67304bb5c26ccbe7c14180a90c4b8291_JaffaCakes118.exe

  • Size

    75KB

  • MD5

    67304bb5c26ccbe7c14180a90c4b8291

  • SHA1

    2b201e457791e4671c45988961554afc7261ea56

  • SHA256

    412e238f557a6bb07e78107de0d883c475398537fdc081432a221322311b64b5

  • SHA512

    ccedb0ae66ade2b3f28c97d43c167f80c7b9f428eed48391550e5114974b697a7a518903ea493db285e8eed01130aaf592361d8ef78f64c2e86f056973009967

  • SSDEEP

    1536:4MHxqNxd3xtdTfzHyl9X3BJe5uBDWlwYOkJWF3TvIqBNpIS4:JHxOdljyj3BJe5u9WhJWZXH4

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\67304bb5c26ccbe7c14180a90c4b8291_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\67304bb5c26ccbe7c14180a90c4b8291_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1480
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsg8907.tmp\NSISdl.dll

    Filesize

    72KB

    MD5

    b13935bfa7a3e43c112bd9fa02f08f28

    SHA1

    dec4f136057097c412f53c2ae41b80a8ad0c6810

    SHA256

    796f7efb91904fa4105528e18f6f87e3fdab9a070dabef83e02f9ae375b2b060

    SHA512

    1b92cde7bf74fc181b4d2602a269ef1f581b75eb67e3e46b256ddaddc153b95ee17d422a56ca04d68eafe61ab468b708f7f3691f3b47c554a67af00d49b2709a

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    75KB

    MD5

    67304bb5c26ccbe7c14180a90c4b8291

    SHA1

    2b201e457791e4671c45988961554afc7261ea56

    SHA256

    412e238f557a6bb07e78107de0d883c475398537fdc081432a221322311b64b5

    SHA512

    ccedb0ae66ade2b3f28c97d43c167f80c7b9f428eed48391550e5114974b697a7a518903ea493db285e8eed01130aaf592361d8ef78f64c2e86f056973009967

  • memory/1480-5-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2192-11-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2192-12-0x0000000010000000-0x000000001001D000-memory.dmp

    Filesize

    116KB

  • memory/2192-15-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB