Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/08/2024, 08:17

General

  • Target

    8dfda245ae054f636ba58ab837404194_JaffaCakes118.exe

  • Size

    14KB

  • MD5

    8dfda245ae054f636ba58ab837404194

  • SHA1

    3d69df2b52ece7f8244aacc16a5cc5b7edc446f3

  • SHA256

    7a07469248f8ba596187821021844bcde2e625bb9177338940bcc412565c4edc

  • SHA512

    99c1eb6f57ee457a71ba5157e5a2d8f4d0939b39eb90ac2eeb45faa3945e51480fd47c1459d45359a767dc2079c3541473aca55fb24f48cc2118855f1c1ca274

  • SSDEEP

    192:vskq35p04P58YREnioSKnLKPy/kRuK5gkoNVeBSb0PEyncjWOS7E25Qg57Qe2Sss:vy/7R8nNLz/25gkOYBSYtnP7EEQZIp

Score
7/10

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8dfda245ae054f636ba58ab837404194_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8dfda245ae054f636ba58ab837404194_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    PID:1292
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 1124
      2⤵
      • Program crash
      PID:1152
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1292 -ip 1292
    1⤵
      PID:4696

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\esplora.lnk

      Filesize

      212B

      MD5

      75edce8ec3fb231917dbaf8b20137dc4

      SHA1

      a257a254c3ea326280aefd7541b00a6d1c0b176e

      SHA256

      d5b98df96c3ca051567a186b69f15eecf87423a51e5726160d1fe6b79b8d23a6

      SHA512

      37ea90bc54ca3a73c674fbc24b01b922914a92ad46bf959478043f089b9c9406a2c61ecb3cb422911742ed2b063db134434fa755e598841f8ef86ee36aaad8b9

    • memory/1292-0-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/1292-13-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB