Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/08/2024, 10:08

General

  • Target

    8e52ea9b566fa5bdada81a463172b09b_JaffaCakes118.exe

  • Size

    947KB

  • MD5

    8e52ea9b566fa5bdada81a463172b09b

  • SHA1

    17d83df2ad641def7aaa2e202cce236dfbb7b5cf

  • SHA256

    92d87785a859e6b2b4a0119c721b53ae0853bec3a98e85b820d68db9c064985b

  • SHA512

    579d611e036a8ea304e38c3820035d8aba2e5bfbfa1681712c704e19faec73d6ef79813c027dcf67d48b6ae5cd0b180a035917d04273d16c91e00e7e753c01c8

  • SSDEEP

    24576:5/Q+nEZNHOFPctZWUd++M+DeMtzu345MXcuZrJcFhP/fWry2ojTg:xINHOFmke6+Pzu345MsuChXu+nXg

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e52ea9b566fa5bdada81a463172b09b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8e52ea9b566fa5bdada81a463172b09b_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Users\Admin\AppData\Local\Temp\is-4MGMQ.tmp\8e52ea9b566fa5bdada81a463172b09b_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-4MGMQ.tmp\8e52ea9b566fa5bdada81a463172b09b_JaffaCakes118.tmp" /SL5="$70042,680297,52224,C:\Users\Admin\AppData\Local\Temp\8e52ea9b566fa5bdada81a463172b09b_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-4MGMQ.tmp\8e52ea9b566fa5bdada81a463172b09b_JaffaCakes118.tmp

    Filesize

    660KB

    MD5

    780f4e49926ce6bf33e7ca591af72c5f

    SHA1

    f31ef7f5440ff84d86543a1b3549cfc617b4ca82

    SHA256

    63806eae37df27592ed83e0ec3314d62e67b9febe5fb2737ee0a8e6fe484e2f5

    SHA512

    367b8b94efeb883dea78de7844fbb1086272dbb650b9efd0e70edc41a18a7d7ae905720851c544b4fed8ca588fe04c89e5a6dd1fb324543e20f3aab0e2caa3e2

  • memory/952-12-0x0000000000400000-0x00000000004B4000-memory.dmp

    Filesize

    720KB

  • memory/952-16-0x0000000000400000-0x00000000004B4000-memory.dmp

    Filesize

    720KB

  • memory/3464-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3464-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/3464-15-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB