Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 19:25

General

  • Target

    8ba88d5e28f32723d1bba68d8836615b_JaffaCakes118.exe

  • Size

    312KB

  • MD5

    8ba88d5e28f32723d1bba68d8836615b

  • SHA1

    d1ef5c3d1db99c099e9df71de660d8b5dae756bc

  • SHA256

    23d88ba7b3f8d5f4787da32eafd270ba152180c424b1fb96ee0d54e14907daed

  • SHA512

    621fd9e6a6227c7d56dc441e0b03069e24ad8921dece28318040bb1f445cb40f7299042aeadbc762bf94665a9a2da808ed7416a47d05dcf7e16467e4ea18d622

  • SSDEEP

    6144:jnpAOgw8HYWO9J9upvIWWXNKHxWtPk3a1lgE9al+vwAN6a8hY/EeW2OhFEsX:jnpH4HYWO9J9UIFKwlgEol+sRhYBWjhz

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ba88d5e28f32723d1bba68d8836615b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8ba88d5e28f32723d1bba68d8836615b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4716
    • C:\Users\Admin\AppData\Local\Temp\8ba88d5e28f32723d1bba68d8836615b_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\8ba88d5e28f32723d1bba68d8836615b_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4716-8-0x0000000077490000-0x0000000077580000-memory.dmp

    Filesize

    960KB

  • memory/4716-17-0x0000000077490000-0x0000000077580000-memory.dmp

    Filesize

    960KB

  • memory/4716-5-0x0000000077842000-0x0000000077843000-memory.dmp

    Filesize

    4KB

  • memory/4716-7-0x00000000774B0000-0x00000000774B1000-memory.dmp

    Filesize

    4KB

  • memory/4716-6-0x00000000005F0000-0x0000000000600000-memory.dmp

    Filesize

    64KB

  • memory/4716-3-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/4716-2-0x00000000022B0000-0x00000000022C0000-memory.dmp

    Filesize

    64KB

  • memory/4716-4-0x0000000000600000-0x0000000000610000-memory.dmp

    Filesize

    64KB

  • memory/4716-1-0x0000000000BC0000-0x0000000000BFD000-memory.dmp

    Filesize

    244KB

  • memory/4716-15-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/4716-9-0x0000000077490000-0x0000000077580000-memory.dmp

    Filesize

    960KB

  • memory/4716-0-0x00000000005E0000-0x00000000005E1000-memory.dmp

    Filesize

    4KB

  • memory/4716-16-0x0000000000BC0000-0x0000000000BFD000-memory.dmp

    Filesize

    244KB

  • memory/4920-12-0x0000000000400000-0x0000000000402000-memory.dmp

    Filesize

    8KB

  • memory/4920-18-0x0000000077490000-0x0000000077580000-memory.dmp

    Filesize

    960KB

  • memory/4920-14-0x0000000000400000-0x0000000000402000-memory.dmp

    Filesize

    8KB

  • memory/4920-19-0x0000000000400000-0x0000000000401800-memory.dmp

    Filesize

    6KB

  • memory/4920-21-0x0000000077490000-0x0000000077580000-memory.dmp

    Filesize

    960KB