Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 16:00

General

  • Target

    74bc280dfc0ac23415dd1f6804446f14_JaffaCakes118.exe

  • Size

    1.6MB

  • MD5

    74bc280dfc0ac23415dd1f6804446f14

  • SHA1

    2143b1f1e45a8dabfd5e5b49bb133cab12a38a6c

  • SHA256

    f6005071fb19ba7c9682a9adfb3e5759591ead66479bb5949c79ecf6a2fa90d0

  • SHA512

    233813e922aae961b94a5992f45035adf7a6974300d6d5acfd0a4fa0621780cefef581b7d58e24f74f82e8a14ed6978c7ef9a7c1326b8311e4904cdd6e9358cd

  • SSDEEP

    24576:kpSbMTHc9fxRAyGxZpEQB9iQGVV9k3hoP6fkTlH08kgMA:kkbVpGyGxZp9iTo3hoA2lH1

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74bc280dfc0ac23415dd1f6804446f14_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\74bc280dfc0ac23415dd1f6804446f14_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:5092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\imedllhost09.ime

    Filesize

    52KB

    MD5

    b60da4e2e5aceba3ce3d87ee2cd872ee

    SHA1

    9bbdbf1f3ce2c000a86e0473da756a4b1031db41

    SHA256

    b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453

    SHA512

    664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874

  • memory/5092-25-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-4-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-49-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-48-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-47-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-44-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-41-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-39-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-38-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-33-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-31-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-29-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-27-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-0-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-35-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-23-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-46-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-11-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-9-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-7-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-19-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-3-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-15-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-17-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-13-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-5-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-2-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-21-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/5092-64-0x0000000004720000-0x000000000472E000-memory.dmp

    Filesize

    56KB

  • memory/5092-84-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB