Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    15s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 19:36

General

  • Target

    a7f13bf164d1009e0362c73873084f42_JaffaCakes118.exe

  • Size

    740KB

  • MD5

    a7f13bf164d1009e0362c73873084f42

  • SHA1

    be90e8a7881b61e30f9401e640a156d0858dc5c7

  • SHA256

    be3424fe002aabf42d4c41bf0ef110663d4459c5845aed5e706ddba955c1edca

  • SHA512

    ac1e5797fb3b8a89a974eff53c4911762b09bdd7affb32914f571877a0f6d76b02dc5ccecedcafe76b86fe21e48ae14d1d7b9ce95649abf974e4ed315e0369be

  • SSDEEP

    12288:7IAKJGD++o3bJ8xQUL8O6jfcWYXVlmYTb8tzqo7ZF3Z4mxxHQgwKQt/dam6:Ke+zbKQqr+fcWxW8j7ZQmXwZKm/dah

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7f13bf164d1009e0362c73873084f42_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a7f13bf164d1009e0362c73873084f42_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:944
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE

    Filesize

    345KB

    MD5

    8f624818c4fe4e49ebc7f4b6aeeb526c

    SHA1

    41a492cec7d094ecde2e3e276ba4eb58a5d26046

    SHA256

    6be8d2cdca243450a7915e19c65573aecd611fea3f7e9735e48489af31376e5b

    SHA512

    389b2780422002e2e277c858b158aac5529ae2242a4e25c4c072c85ac33ada53f72f3464925bc37b1dd8182c7dadc3c64e36d6daa441e53a556ddd0efc3c2a7f

  • memory/944-0-0x0000000001000000-0x000000000112B000-memory.dmp

    Filesize

    1.2MB

  • memory/944-1-0x00000000006C0000-0x0000000000714000-memory.dmp

    Filesize

    336KB

  • memory/944-4-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

    Filesize

    4KB

  • memory/944-57-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-59-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-64-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-63-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-62-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-61-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-60-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-58-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-56-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-55-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-54-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-53-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-52-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-51-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-50-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-49-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-48-0x0000000000C40000-0x0000000000C41000-memory.dmp

    Filesize

    4KB

  • memory/944-47-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-46-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-45-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-44-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-43-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-42-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-41-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-40-0x0000000000D10000-0x0000000000D11000-memory.dmp

    Filesize

    4KB

  • memory/944-39-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

    Filesize

    4KB

  • memory/944-38-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

    Filesize

    4KB

  • memory/944-37-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

    Filesize

    4KB

  • memory/944-36-0x0000000000D00000-0x0000000000D01000-memory.dmp

    Filesize

    4KB

  • memory/944-35-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-34-0x0000000000C00000-0x0000000000C01000-memory.dmp

    Filesize

    4KB

  • memory/944-33-0x0000000000C80000-0x0000000000C81000-memory.dmp

    Filesize

    4KB

  • memory/944-32-0x0000000000C50000-0x0000000000C51000-memory.dmp

    Filesize

    4KB

  • memory/944-31-0x0000000000C60000-0x0000000000C61000-memory.dmp

    Filesize

    4KB

  • memory/944-30-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

    Filesize

    4KB

  • memory/944-29-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

    Filesize

    4KB

  • memory/944-28-0x0000000000C70000-0x0000000000C71000-memory.dmp

    Filesize

    4KB

  • memory/944-27-0x0000000000C20000-0x0000000000C21000-memory.dmp

    Filesize

    4KB

  • memory/944-26-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-25-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-24-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-23-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/944-22-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-21-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-20-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-19-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-18-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-17-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-16-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-15-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-14-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

    Filesize

    4KB

  • memory/944-13-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-12-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-11-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-10-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-9-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/944-8-0x00000000005A0000-0x00000000005A1000-memory.dmp

    Filesize

    4KB

  • memory/944-7-0x00000000005B0000-0x00000000005B1000-memory.dmp

    Filesize

    4KB

  • memory/944-6-0x0000000000540000-0x0000000000541000-memory.dmp

    Filesize

    4KB

  • memory/944-5-0x0000000000550000-0x0000000000551000-memory.dmp

    Filesize

    4KB

  • memory/944-3-0x0000000000570000-0x0000000000571000-memory.dmp

    Filesize

    4KB

  • memory/944-2-0x0000000000590000-0x0000000000591000-memory.dmp

    Filesize

    4KB

  • memory/944-71-0x0000000001000000-0x000000000112B000-memory.dmp

    Filesize

    1.2MB

  • memory/944-72-0x00000000006C0000-0x0000000000714000-memory.dmp

    Filesize

    336KB

  • memory/944-73-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/3940-70-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB

  • memory/3940-75-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB