Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 20:01

General

  • Target

    a804a8ad0ec05e4a58a5a6a0aa266bc7_JaffaCakes118.exe

  • Size

    28KB

  • MD5

    a804a8ad0ec05e4a58a5a6a0aa266bc7

  • SHA1

    132b1240a3983e72d1580c5aa97e0d84018d53d1

  • SHA256

    72af70d33b9ca846a643869b25d400c2dc7ec5b8412a6668d6c9e9da9b54a4df

  • SHA512

    79732c0c3b806adeae22526641187d4c7043d73034bd449c2ab8dfa8e88eae2e1539e6f214660ca5e9ad841fc02236237161d457281222649a14077e3ed3dbd9

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN5ZwL:Dv8IRRdsxq1DjJcqfn

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a804a8ad0ec05e4a58a5a6a0aa266bc7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a804a8ad0ec05e4a58a5a6a0aa266bc7_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:5116

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G40JFEW9\search[2].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NMN7D09E\default[2].htm

    Filesize

    303B

    MD5

    716cb7f5b783829c36e49996fc0bf627

    SHA1

    63471c20af48dd7052d63a695a12d86e2fc6871d

    SHA256

    6ad9b32ca3ec43c9017ab8f11b6f82e7ed43083efddf1ef74a3165f778312b40

    SHA512

    c3d126513cad64785ae5a16c5564cee6d7da1d26682d93d00a04937d9f98a89f54c74f5dda0c200c77f092fd8092db4f4f7a7a8544057eeb83d058f28fdf0346

  • C:\Users\Admin\AppData\Local\Temp\tmp28CB.tmp

    Filesize

    28KB

    MD5

    355f32e2804d37689271ffce8b8cbe4e

    SHA1

    eec1085d839efe2dbff2533fa201ad0f604cee79

    SHA256

    d26ee5beb03836599d2b5636cbe75e7e1f5d913ef10baa8e28e71e5a073af789

    SHA512

    760cc6981abcf2ec62d05c1c19ff59981c0d9a1bf2190f44bc0f09ead2f00c794ce9858a74083cd0f4afff170cfe16b9cd0d83209910191e0272b8e99955b5ed

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    30fd5a2512a3d17cf4d42ac7318d4da6

    SHA1

    cec40d5edd375ca3dcab9e9fe26d4d6b5055a2cb

    SHA256

    c5e33b2773d815c84f7f95c90d1c3c46909544326f95b62b8aec162853d5dc54

    SHA512

    d7ab8c6e3f376282919b528ef4b7a9638e56aded22c572b716dd621c1b8974232859b8f7506b479e92a7260f228487724682a08aa20fe45508eb963a8a0109f5

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    84540c54e360b23268e89c2bfb2143b7

    SHA1

    025802c090d260f7666631ca6c2d96b90d144446

    SHA256

    6d8f7bd02e3a3560ffff84e87222a49a9e5150ee38fd3ddb060acb66632c1edc

    SHA512

    d196bd8aa2d93937fe693a818063e1de97cb19972a5593cf5289e309ef11f4e8fbd035da6eae2cbd976fbe0f1bdae0aca231d4054469366fcd6bfb9b426beb81

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    fb4abca6a14901f21df9fc1077cad617

    SHA1

    445740367911d24a3a265424f10654e85dfc6019

    SHA256

    a1ac01a2bf56601240a8019c64024d240421300882c696089add27d977939250

    SHA512

    f1ec9addb68117ba37e1e433abb842b229e9ec85a280005120a077654d12dbd40dab584362fbdfeaef082a5d583e1aa2c1004d6072cf6c3dd32c27c96717a745

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2568-49-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2568-125-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2568-183-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2568-176-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2568-172-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2568-13-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2568-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/5116-126-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-45-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-50-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-28-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-15-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-40-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-173-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-177-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-38-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-179-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-33-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-184-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5116-5-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB