Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 01:52

General

  • Target

    a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe

  • Size

    60KB

  • MD5

    a4edec6f62e63cc295b49aa92b255756

  • SHA1

    179efe111d0dc41861a4d7409d7ace790296af10

  • SHA256

    88a8c76052ff70221a54aeb4828667674062e82091d8ea3f445ce51d29992fd4

  • SHA512

    1d78023e8825cc2735611ccc8c41e405bb5da5c3600dc7dd0cb9b909e67abd78005f6208eaac84fe9e39ed937d207de00dec70c76c2275219e0f2e971fbb451c

  • SSDEEP

    768:vCru/f9Iw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRiTWNReOOJ:71Tzy48untU8fOMEI3jyYfPiuOJ

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B72A.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe""
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1560
      • C:\Windows\SysWOW64\iexpress.exe
        iexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4856
        • C:\Windows\SysWOW64\makecab.exe
          C:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\B72A.tmp\1.bat

    Filesize

    1KB

    MD5

    02dba5f37067292355c6d01a57d4ef48

    SHA1

    7c67ab3f99fbf7a53018dd295d2968c525db83d9

    SHA256

    8b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242

    SHA512

    12201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a

  • C:\Users\Admin\AppData\Local\Temp\popup.sed

    Filesize

    60KB

    MD5

    e70e868081d3bd63a5d7ea8fee1c02b2

    SHA1

    da5060a86cb5e33006cfcc55265a601c7fb3f291

    SHA256

    efe214875d04b97ea312041e0330620ac90f24d38d5f5d99917a602c29f90162

    SHA512

    0dc0e9c63b2ceb6a9af565f4cfae46a9f1792956a6863b0b1bfc958c49eb7091089db892e382b877d81f3aaec0489662d51e0e51a487badf648957f7237ffb34

  • C:\Users\Admin\AppData\Local\Temp\~%TargetName%.DDF

    Filesize

    724B

    MD5

    c3ca008abd6997c4b036a7e8be75cb2c

    SHA1

    05f7a3527bb04c691b08f040f562582035398829

    SHA256

    29ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3

    SHA512

    bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083