Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 17:51
Static task
static1
Behavioral task
behavioral1
Sample
b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe
-
Size
216KB
-
MD5
b47005de33ed2b076fd32bd2adc39d83
-
SHA1
ffb0b4450341e2c04d39cb3845e879af2c5961bf
-
SHA256
509acabc2196bd8e98d6480d46f9358f199e55740579145b8a4a6ca8e90d76f0
-
SHA512
01bedf9a27e1c777170cd950826a5f4c6b126904bb4f7fac42380d2c823154d4d69bf4472ceb621947601cc5f5fb514307d0f768427fb17783928b035ec8b442
-
SSDEEP
6144:Q6WEDffYdnsWF3HGtuvNhUmtPxNp7wWer7Wq6yvDE:Q9E7fYdnNXGtAzsWm6yg
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1160 rundll32.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 4688 1160 WerFault.exe 84 3936 1156 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1156 wrote to memory of 1160 1156 b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe 84 PID 1156 wrote to memory of 1160 1156 b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe 84 PID 1156 wrote to memory of 1160 1156 b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ndcyox.dll,Install2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1160 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 5683⤵
- Program crash
PID:4688
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 5322⤵
- Program crash
PID:3936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1160 -ip 11601⤵PID:2236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1156 -ip 11561⤵PID:4760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD53038c779df2ad97b71102a689cd866cf
SHA1e56d6e0c0545f2c6d9187ce06c0c3fe17aa51db0
SHA256bd0e43ed3cd340145b55fc1685c66a644426127041b1dad97a563b31e8733f09
SHA5121a80f5276593541a94842d627a4f11b4bfa768ce0e00c15176d8de2e975a4084ee9fc78eb272aebf3a60cf2419d76814a0b408b631099a284cb86a82a28bc5f2