Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17/08/2024, 17:05
General
-
Target
a364d6a1d481fbadc27d8825f28d68a7_JaffaCakes118.exe
-
Size
344KB
-
MD5
a364d6a1d481fbadc27d8825f28d68a7
-
SHA1
16aa8f4c396f30ef1ceed8cdf67b1f40a6280f77
-
SHA256
f3cf44fbcfec9317705f27580b85150a69cd9d08074b3ad03dec55d68236e639
-
SHA512
c45e500860c126a9fe0cafaceb7f710552dfb0e7caf4d7a9d8c1db4a9ddd79c129b18c0c5f3964f85a0e3da73def7949d43f1da93cc95ec3993dfa7b0c8531ae
-
SSDEEP
6144:cee6TyFwuoqUW8sjQHTyScGXSgcl/Nb/oAMTCR:Ve6Ty8qJmTyjGXSgcl/VUWR
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a364d6a1d481fbadc27d8825f28d68a7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a364d6a1d481fbadc27d8825f28d68a7_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd8b983934.bat"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 1482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1768 -ip 17681⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
277B
MD51e79fde69fded90005290b5f9f4f527e
SHA1c2640631afdd0a5fc0cfb30b512f0b24fd3fff52
SHA2564e8962b1210f90efe793da33f3700a4be39ce52d1ae8caa3b385bbb2fa29ac40
SHA51279cc1ce3be77f6a3d29c54f5ef5b2248fc4940736629b2bc144584f990a82a278f07e5d440e25a9c2dbecae3fa173d2a0478bbaa192a5b6d0c2894435a43b140
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
532KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
532KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
436KB
-
Filesize
4KB
-
Filesize
436KB