Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 01:28

General

  • Target

    b9d63b7de002889a56ba8e565cc0dcf2_JaffaCakes118.exe

  • Size

    533KB

  • MD5

    b9d63b7de002889a56ba8e565cc0dcf2

  • SHA1

    b34aaf7785f336455d4e6685da2340edef4fa8b6

  • SHA256

    bebf857dfb4ff7fa7206266c725300a5c58026a03ee253fcabbccf4b66f85cde

  • SHA512

    e39db303de3ed6529ba665821cd42c45df57c3a4f46bc47c317fd8ea4594617f949d3d958b64ceea361b0a2cc51142d243ed7c6f249f5447ae72faf165ced59d

  • SSDEEP

    12288:oZcWo20Yoj44v7X2pPEawpgbCTBP7Z2xUuv03Mjz2:oSWo20YqTG1KxV7EUD3M3

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9d63b7de002889a56ba8e565cc0dcf2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b9d63b7de002889a56ba8e565cc0dcf2_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5108
    • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
      "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -jar "C:\Users\Admin\AppData\Local\Temp\\run.jar" "C:\Users\Admin\AppData\Local\Temp\b9d63b7de002889a56ba8e565cc0dcf2_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      PID:4444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\jna7039291266048847415.dll

    Filesize

    192KB

    MD5

    f2607244d71e97c5fc7cbdad20edaa8b

    SHA1

    ce115bd61a7f2d344c38cc87dcd4989d800cf836

    SHA256

    1c004e78bed0a80f0f46e6fa094db3a4c8102fac3cf95579e6f0eb72bdd9dc7d

    SHA512

    3671b503561724eae650570d2e518c01332bd7a7a2e6d5ee064701ad4ba02be80ac97936c27e68333c2f42bc4b7ecda533ea6e3e0e1324c56bc52a8e33c332d5

  • C:\Users\Admin\AppData\Local\Temp\run.jar

    Filesize

    493KB

    MD5

    c19a44b3edacff5cf649076f201ecc51

    SHA1

    1ab24529dc97596080dcbd65aff5d0c76aa8fea2

    SHA256

    d076998d51aeba1b6943972b7baacbe415dfb1a02468c4716111cb7c70295624

    SHA512

    ea3b6ef95f8d7d867a0d5ff28c1597502aa0fe737a27c2115c67e61dfa1a0d3ec1881eea2c8295f67915e7e41153972c1f7d887172b790fc75a915eea30e2e1f

  • memory/4444-37-0x000001F8EA510000-0x000001F8EA520000-memory.dmp

    Filesize

    64KB

  • memory/4444-39-0x000001F8EA520000-0x000001F8EA530000-memory.dmp

    Filesize

    64KB

  • memory/4444-25-0x000001F8EA4B0000-0x000001F8EA4C0000-memory.dmp

    Filesize

    64KB

  • memory/4444-27-0x000001F8EA4C0000-0x000001F8EA4D0000-memory.dmp

    Filesize

    64KB

  • memory/4444-31-0x000001F8EA4E0000-0x000001F8EA4F0000-memory.dmp

    Filesize

    64KB

  • memory/4444-30-0x000001F8EA4D0000-0x000001F8EA4E0000-memory.dmp

    Filesize

    64KB

  • memory/4444-34-0x000001F8EA4F0000-0x000001F8EA500000-memory.dmp

    Filesize

    64KB

  • memory/4444-35-0x000001F8EA500000-0x000001F8EA510000-memory.dmp

    Filesize

    64KB

  • memory/4444-7-0x000001F8EA240000-0x000001F8EA4B0000-memory.dmp

    Filesize

    2.4MB

  • memory/4444-16-0x000001F8EA220000-0x000001F8EA221000-memory.dmp

    Filesize

    4KB

  • memory/4444-46-0x000001F8EA220000-0x000001F8EA221000-memory.dmp

    Filesize

    4KB

  • memory/4444-47-0x000001F8EA240000-0x000001F8EA4B0000-memory.dmp

    Filesize

    2.4MB

  • memory/4444-55-0x000001F8EA520000-0x000001F8EA530000-memory.dmp

    Filesize

    64KB

  • memory/4444-54-0x000001F8EA510000-0x000001F8EA520000-memory.dmp

    Filesize

    64KB

  • memory/4444-53-0x000001F8EA500000-0x000001F8EA510000-memory.dmp

    Filesize

    64KB

  • memory/4444-52-0x000001F8EA4F0000-0x000001F8EA500000-memory.dmp

    Filesize

    64KB

  • memory/4444-51-0x000001F8EA4D0000-0x000001F8EA4E0000-memory.dmp

    Filesize

    64KB

  • memory/4444-50-0x000001F8EA4E0000-0x000001F8EA4F0000-memory.dmp

    Filesize

    64KB

  • memory/4444-49-0x000001F8EA4C0000-0x000001F8EA4D0000-memory.dmp

    Filesize

    64KB

  • memory/4444-48-0x000001F8EA4B0000-0x000001F8EA4C0000-memory.dmp

    Filesize

    64KB