Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 03:50

General

  • Target

    a9791159c5f31a893679a99b0cc6d14a_JaffaCakes118.exe

  • Size

    322KB

  • MD5

    a9791159c5f31a893679a99b0cc6d14a

  • SHA1

    18047c75332e1dd8d7fa6b2725335b0a0b864f03

  • SHA256

    45054258a3f84036e54ad21b287a974a863def6637d5e739f996b12560225dc3

  • SHA512

    92057cc971059df3c96ae77d70a27a1368f506b182618a8df9a720ad99a61489e528c79f63d880ee16858c58bbd017b9ebe7cbaaf1be3ad5fee29f709e6b3fe1

  • SSDEEP

    6144:sl6A9EpKroUuHH70fV+QM6GgoZW93x678qe7PhkIOeVdHw0aNPsl5:q9EyBu70fRM9DWVRp7PhfdHuNPs/

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9791159c5f31a893679a99b0cc6d14a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a9791159c5f31a893679a99b0cc6d14a_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4536
    • C:\Users\Admin\AppData\Local\Temp\Torchsoft Malware Defender v2 0 5 Incl Keygen and.Pa tch-BRD.exe
      "C:\Users\Admin\AppData\Local\Temp\Torchsoft Malware Defender v2 0 5 Incl Keygen and.Pa tch-BRD.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4708
    • C:\Users\Admin\AppData\Local\Temp\7za.exe
      C:\Users\Admin\AppData\Local\Temp\7za.exe x C:\Users\Admin\AppData\Local\Temp\a1.7z -aoa -oC:\Users\Admin\AppData\Local\Temp -plolmilf
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:708
    • C:\Users\Admin\AppData\Local\Temp\ic1.exe
      "C:\Users\Admin\AppData\Local\Temp\ic1.exe"
      2⤵
      • Executes dropped EXE
      PID:1160

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7za.exe

    Filesize

    523KB

    MD5

    e92604e043f51c604b6d1ac3bcd3a202

    SHA1

    4154dda4a1e2a5ed14303dc3d36f448953ff6d33

    SHA256

    fa252e501332b7486a972e7e471cf6915daa681af35c6aa102213921093eb2a3

    SHA512

    ef396d94d83fd7a588c6e645ea5fcfe24390440a03b3bf0ecd05ca6749fd3f9561dfafe725ee0edea51a34d52af26cd311e768aa72f75686cc796abee4757d43

  • C:\Users\Admin\AppData\Local\Temp\Torchsoft Malware Defender v2 0 5 Incl Keygen and.Pa tch-BRD.exe

    Filesize

    90KB

    MD5

    c647ab2b595610bcbfc5a8cd14e67d1e

    SHA1

    471da010a50c5efc6d5fd9f61bd1970facca65fe

    SHA256

    ce294b615bd1a8d8c57705d5aaff9add06584cd741a600829a3a1620a4631f89

    SHA512

    2ddaf91142c07126330b7c13137ae47fdf5db890ec3a7834c8f624e764017a56615cc4b442c1adbe99213781e154969936b4aa0ed44c680dfa233618cb8b0813

  • C:\Users\Admin\AppData\Local\Temp\a1.7z

    Filesize

    7KB

    MD5

    fe1a3c6046eaa4de86b2f37d5d5d9fec

    SHA1

    254d7411106436e9c583b21fb3aabd11665b4ad2

    SHA256

    760db114cd6711fd8c5df7f0ddc7e0b641c8c585dbe199b4a316e726ed390c11

    SHA512

    1ad719b52a294441c101e1d40babc8dd4ea0d39286d93d3047d024a1590f8e48ccff556bea5469eb1713294b04760ee656f627d4876a9cdf657eadf87a00b0fc

  • C:\Users\Admin\AppData\Local\Temp\ic1.exe

    Filesize

    18KB

    MD5

    b64b538899d4588a05d7d3db92918448

    SHA1

    b2d0b29a9c69bac6b22f696474eb031cca664f9a

    SHA256

    803abec016d53636f2817c972f2c769beb36501fc8bd30c73994958eb94cfb29

    SHA512

    ba4732c7a25dfdd636009a5ec8597e233c7c2b736b9c08a07dce13de70d9e0e08652b7f323ab590a29b57da12bf6a347675b2103bdfef06a80dbfd555ad09727

  • C:\Users\Admin\AppData\Local\Temp\nsv6E7B.tmp\ExecDos.dll

    Filesize

    5KB

    MD5

    a7cd6206240484c8436c66afb12bdfbf

    SHA1

    0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919

    SHA256

    69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926

    SHA512

    b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904

  • memory/1160-28-0x000000001B910000-0x000000001B9B6000-memory.dmp

    Filesize

    664KB

  • memory/1160-27-0x0000000001430000-0x0000000001440000-memory.dmp

    Filesize

    64KB

  • memory/1160-29-0x000000001BE90000-0x000000001C35E000-memory.dmp

    Filesize

    4.8MB

  • memory/1160-30-0x000000001C4B0000-0x000000001C54C000-memory.dmp

    Filesize

    624KB

  • memory/1160-31-0x0000000001570000-0x0000000001578000-memory.dmp

    Filesize

    32KB

  • memory/1160-32-0x000000001C610000-0x000000001C65C000-memory.dmp

    Filesize

    304KB

  • memory/1160-33-0x000000001C6C0000-0x000000001C720000-memory.dmp

    Filesize

    384KB

  • memory/1160-37-0x0000000001430000-0x0000000001440000-memory.dmp

    Filesize

    64KB