Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 21:25

General

  • Target

    a431559eaa41fa4db289d5339ccb0495_JaffaCakes118.exe

  • Size

    178KB

  • MD5

    a431559eaa41fa4db289d5339ccb0495

  • SHA1

    69423439aad9b5c5719f1b448ce9066ae5330f49

  • SHA256

    d96e71a6bea5220658321d9a7d8d244c928d261978c6e7bb39157e824e2a787b

  • SHA512

    c5bcf637a8b72541b70dc2b27ec3a57ba2c5e154a9a5215c9b7b7af0766d26f4e13af7e376bd92b50010b0ea60c6a8e40aa8c7699e35b13b0f03954daeb524b9

  • SSDEEP

    3072:AQIURTXJL459oCFtMxmoS5Jhi0ga5Uc3xtqazwSd1A/9/oV5/BMmvTriApF1:AspiXKmoamu5UMtqKTdnV5/B/7riA/1

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a431559eaa41fa4db289d5339ccb0495_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a431559eaa41fa4db289d5339ccb0495_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:4224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsz858D.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    a401e590877ef6c928d2a97c66157094

    SHA1

    75e24799cf67e789fadcc8b7fddefc72fdc4cd61

    SHA256

    2a7f33ef64d666a42827c4dc377806ad97bc233819197adf9696aed5be5efac0

    SHA512

    6093415cd090e69cdcb52b5d381d0a8b3e9e5479dac96be641e0071f1add26403b27a453febd8ccfd16393dc1caa03404a369c768a580781aba3068415ee993f

  • C:\Users\Admin\AppData\Local\Temp\nsz858D.tmp\System.dll

    Filesize

    11KB

    MD5

    00a0194c20ee912257df53bfe258ee4a

    SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

    SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

  • C:\Users\Admin\AppData\Local\Temp\nsz858D.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    ab73c0c2a23f913eabdc4cb24b75cbad

    SHA1

    6569d2863d54c88dcf57c843fc310f6d9571a41e

    SHA256

    3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457

    SHA512

    99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8