Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 01:52
Static task
static1
Behavioral task
behavioral1
Sample
a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe
-
Size
60KB
-
MD5
a4edec6f62e63cc295b49aa92b255756
-
SHA1
179efe111d0dc41861a4d7409d7ace790296af10
-
SHA256
88a8c76052ff70221a54aeb4828667674062e82091d8ea3f445ce51d29992fd4
-
SHA512
1d78023e8825cc2735611ccc8c41e405bb5da5c3600dc7dd0cb9b909e67abd78005f6208eaac84fe9e39ed937d207de00dec70c76c2275219e0f2e971fbb451c
-
SSDEEP
768:vCru/f9Iw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRiTWNReOOJ:71Tzy48untU8fOMEI3jyYfPiuOJ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexpress.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language makecab.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1560 1656 a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe 85 PID 1656 wrote to memory of 1560 1656 a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe 85 PID 1656 wrote to memory of 1560 1656 a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe 85 PID 1560 wrote to memory of 4856 1560 cmd.exe 86 PID 1560 wrote to memory of 4856 1560 cmd.exe 86 PID 1560 wrote to memory of 4856 1560 cmd.exe 86 PID 4856 wrote to memory of 2852 4856 iexpress.exe 87 PID 4856 wrote to memory of 2852 4856 iexpress.exe 87 PID 4856 wrote to memory of 2852 4856 iexpress.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B72A.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\a4edec6f62e63cc295b49aa92b255756_JaffaCakes118.exe""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵
- System Location Discovery: System Language Discovery
PID:2852
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
60KB
MD5e70e868081d3bd63a5d7ea8fee1c02b2
SHA1da5060a86cb5e33006cfcc55265a601c7fb3f291
SHA256efe214875d04b97ea312041e0330620ac90f24d38d5f5d99917a602c29f90162
SHA5120dc0e9c63b2ceb6a9af565f4cfae46a9f1792956a6863b0b1bfc958c49eb7091089db892e382b877d81f3aaec0489662d51e0e51a487badf648957f7237ffb34
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083