Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 16:47

General

  • Target

    74e422a6bf0e1cf71ae14c46f5756e55_JaffaCakes118.exe

  • Size

    729KB

  • MD5

    74e422a6bf0e1cf71ae14c46f5756e55

  • SHA1

    901bc0ae05063b4313c39619158b98628eb90a7f

  • SHA256

    9a46957f60e81f9ebf8bd0dc853ada33ad849cd8a7e19208efed41f6bbaa5fdc

  • SHA512

    1c14975fb6aec5d94344ce30542a3d67e8c969ecffde1d82511e87675f2457ef7dd4d71fe4001d02a7dfff7c7b3d370fb6536ef5c377eb862e1698d95ebd75e0

  • SSDEEP

    12288:C3R3vxPBuav4mPZhyK6KGZ4B7sgcy0PEH3MJ/vy3yi1X6DP7BHH:CB3BBxJl62b10Pi3MZDi8DTBHH

Score
7/10

Malware Config

Signatures

  • Uses the VBS compiler for execution 1 TTPs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74e422a6bf0e1cf71ae14c46f5756e55_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\74e422a6bf0e1cf71ae14c46f5756e55_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3436-0-0x00007FFA43465000-0x00007FFA43466000-memory.dmp

    Filesize

    4KB

  • memory/3436-1-0x000000001B6E0000-0x000000001B786000-memory.dmp

    Filesize

    664KB

  • memory/3436-2-0x00007FFA431B0000-0x00007FFA43B51000-memory.dmp

    Filesize

    9.6MB

  • memory/3436-3-0x000000001BCE0000-0x000000001C1AE000-memory.dmp

    Filesize

    4.8MB

  • memory/3436-4-0x00007FFA431B0000-0x00007FFA43B51000-memory.dmp

    Filesize

    9.6MB

  • memory/3436-5-0x000000001C280000-0x000000001C31C000-memory.dmp

    Filesize

    624KB

  • memory/3436-6-0x0000000001000000-0x0000000001008000-memory.dmp

    Filesize

    32KB

  • memory/3436-7-0x000000001C3E0000-0x000000001C42C000-memory.dmp

    Filesize

    304KB

  • memory/3436-8-0x00007FFA431B0000-0x00007FFA43B51000-memory.dmp

    Filesize

    9.6MB

  • memory/3436-9-0x00007FFA431B0000-0x00007FFA43B51000-memory.dmp

    Filesize

    9.6MB

  • memory/3436-10-0x00007FFA43465000-0x00007FFA43466000-memory.dmp

    Filesize

    4KB