Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 21:04
Static task
static1
Behavioral task
behavioral1
Sample
a833b85e929be923537f78905a382c37_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a833b85e929be923537f78905a382c37_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a833b85e929be923537f78905a382c37_JaffaCakes118.exe
-
Size
476KB
-
MD5
a833b85e929be923537f78905a382c37
-
SHA1
0462f6e2e2d7a74d18e0d0b32d6a358c8a05de2b
-
SHA256
cde6cf494da932e219e033a65f12afefa00792351f1aed30257109bf45d78755
-
SHA512
80164880b33435e36146f2651b06a08660b1d7bf9e68959b4711a18ab154ba5375e234c40edb9e5be2eeb00216dd9c46e6d615c0e75ed5b55c489ffe1e167069
-
SSDEEP
6144:TjtisVV/LU/lgx0TJV//gBiRt9KxMtmkA2R3ddr92gjr2Shyk5lYw9J1WV/:f1VTju/L9wod0utX5+w9zI
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a833b85e929be923537f78905a382c37_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1932 a833b85e929be923537f78905a382c37_JaffaCakes118.exe 1932 a833b85e929be923537f78905a382c37_JaffaCakes118.exe 1932 a833b85e929be923537f78905a382c37_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1932 wrote to memory of 4380 1932 a833b85e929be923537f78905a382c37_JaffaCakes118.exe 85 PID 1932 wrote to memory of 4380 1932 a833b85e929be923537f78905a382c37_JaffaCakes118.exe 85 PID 1932 wrote to memory of 4380 1932 a833b85e929be923537f78905a382c37_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\a833b85e929be923537f78905a382c37_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a833b85e929be923537f78905a382c37_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\DSCF2332.JPG2⤵
- System Location Discovery: System Language Discovery
PID:4380
-