Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/08/2024, 12:06

General

  • Target

    9609200e202f371c2e981de8674c0374_JaffaCakes118.exe

  • Size

    210KB

  • MD5

    9609200e202f371c2e981de8674c0374

  • SHA1

    7918b9b64dad3139f8b19658ab08407102c0ab38

  • SHA256

    149bc7bb666f2eabcf946822bd316709ddeeef787f059687415f98c71ad47783

  • SHA512

    1e3c7ef62291f7d5a067086d0308e9e9d85ab3904d7303b269d2b4b70998ca75795e7289277426da28af0bfef16b3fabe42175626e3123dd1d28e4256a6f9506

  • SSDEEP

    3072:4BkfJpRXATwMdFCcCbjmmLYLRX25u3foM5AQcbcKfC3icbsaLaLVMsObC6Rt:4qjI2JU6mAQ9RbjLeMsO5t

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9609200e202f371c2e981de8674c0374_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9609200e202f371c2e981de8674c0374_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5048
    • C:\Users\Admin\AppData\Local\Temp\9609200e202f371c2e981de8674c0374_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\9609200e202f371c2e981de8674c0374_JaffaCakes118.exe"
      2⤵
        PID:4956
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1008
        2⤵
        • Program crash
        PID:3044
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5048 -ip 5048
      1⤵
        PID:3264

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nsbAEBF.tmp\System.dll

        Filesize

        11KB

        MD5

        fccff8cb7a1067e23fd2e2b63971a8e1

        SHA1

        30e2a9e137c1223a78a0f7b0bf96a1c361976d91

        SHA256

        6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

        SHA512

        f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

      • C:\Users\Admin\AppData\Local\Temp\rva11.dll

        Filesize

        11KB

        MD5

        188990101a629d59f5435a64c19b655e

        SHA1

        c8fc89b69858fceeeb4f78a3d20cee3f6a0beb42

        SHA256

        755ea4c08bae90f85e93cea3865580400c5dd9fe238dde5c59dfd893dcecf4f4

        SHA512

        1e0f096551159532ad4d773639792841710c48eacca02b46c05be2c90e1e6b3f87470a3a379461694ffdfbe76509f1f7876f5c045d4bcee250e5905632506597

      • memory/5048-10-0x0000000010000000-0x0000000010006000-memory.dmp

        Filesize

        24KB

      • memory/5048-11-0x0000000010000000-0x0000000010006000-memory.dmp

        Filesize

        24KB