Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 08:53

General

  • Target

    aa5d35e8a06a26e1d765b14d98987b34_JaffaCakes118.exe

  • Size

    72KB

  • MD5

    aa5d35e8a06a26e1d765b14d98987b34

  • SHA1

    af0f50ae9757e6b02561ffe2ccdece94fd6c5382

  • SHA256

    c08a4c5ebe21926616e2270067762689f88d6a1bc6662576272f075770c906f4

  • SHA512

    e3cd02e2446e37ed89e7e20092863c5029709921b758d711bf65d0f4bb95d766894d56b989cda3fb1bb2bcca82464a17c7e7858dbed3b90acf4a5ffcd3f3040c

  • SSDEEP

    1536:ZCxFYReRz2WHtHRHzH6tLj5YpQqNldFeLDNlN1yHzDR2LYpyTU7gt:87YReRGtLj5YpQqNldFeLDNlN11

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa5d35e8a06a26e1d765b14d98987b34_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\aa5d35e8a06a26e1d765b14d98987b34_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:648
    • C:\Users\Admin\siouqo.exe
      "C:\Users\Admin\siouqo.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\siouqo.exe

    Filesize

    72KB

    MD5

    1f1651f5afd531bfaa082ea7028b6805

    SHA1

    55a0690f8e4ff2d062cd762586f5f25ea7a51515

    SHA256

    6071ca3d08717cee2d7424d53a2128fbfb81e97260919320fe92a72bca6d3589

    SHA512

    9a3014b35fc49c3176ed52a3dcbda3c91d3cedaa5086a5450e2d4e80b604554f5823a42bc1d8a9134eaf104d64f1c07244fb3bc1d7aa160bbc663e8626c7fff8