Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
26/07/2024, 21:46
General
-
Target
75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe
-
Size
3.8MB
-
MD5
75db01c8c2c40b75d70a290f4c086aa9
-
SHA1
8c2f91b9e7565ae84841e6d0d684928901674fba
-
SHA256
09e9d01738fe9fbcf7fbc165aba42f72a2766f83ee24fae0d2d368a8f7a72e0b
-
SHA512
feade716992458e9bdf628298bd91ea4c273c14a2af7e7b1157d10b7a61077ec33f5eb5934ee944798cfdad62107fd68708e2fcb9354f979824e984f156c0ce3
-
SSDEEP
98304:mgtaf3lv94EdV5xujnTTeElreGy9G927MG0yYwna9r+tNxttaU:efZdV5xujOElX92YG0fwny6Lj
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0V5OO.tmp\75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-0V5OO.tmp\75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp" /SL5="$60292,3625123,54272,C:\Users\Admin\AppData\Local\Temp\75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0SP98.tmp\rkverify.exe"C:\Users\Admin\AppData\Local\Temp\is-0SP98.tmp\rkverify.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD55ac09190daf249c3e93c3ac961067024
SHA1bad9c0d552d54310f669d66b549dcada90583812
SHA256f4934185f75518a13ef5425959f47516cc8467f513e838a82e749ffb782d7e23
SHA5122a87686c038e8a34f8e04a844726de564a08baeedc87632219b86f455d5222efe2ed7557fad9658627e304d916a75cfcb3c9dede4e72057a070f64370aa52f39
-
Filesize
268KB
MD5020ce95075f8c93e6cc957953d7f4589
SHA1e192a200e36974b8e0637230a8cb5905090f7555
SHA256df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3
SHA512fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170
-
Filesize
677KB
MD5c04af2e8479e97b7734a912456464ca8
SHA1abc4a5744c5a48bde3644ed92fc8a685d56cd60b
SHA2569e18f7e9753f2951bf13f8cd2e972202af5d87b21b54a5e2b2bc53e1285ead48
SHA5126b820ecb369e0b86acdade06d17552b2c9aa953bc3b65dff52eb4388393bbe5b36eaa9518f86d3f25ea2758fe3b03b184a74f2585268d6063c2ff8a4e72a132c
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
1.6MB
-
Filesize
880KB
-
Filesize
144KB
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
80KB