Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23/08/2024, 03:35
General
-
Target
ba32e2b25eed047ff2300e2c4899f3b2_JaffaCakes118.exe
-
Size
901KB
-
MD5
ba32e2b25eed047ff2300e2c4899f3b2
-
SHA1
87746ec58759f5ca09fa4c3ed978fa9813bf97e1
-
SHA256
5560e0103ba15d3ad1e76179efa36551cad0c3f3fa63539a65be7ebae9a6227c
-
SHA512
6e8318aa3c5e1c652882fa285d9c9d22f3dff61c203759e8fbc06967a533c23cc9f28032f27fd504b8b36c65b894ff17fddc6c9a663d2d84e18b24e0e2009a5d
-
SSDEEP
12288:ZM/7/2szUtFPjY+anpaFlQuKzCg5NTSB22VYroT0Iw5pdFT2ETLpUY:ZML8j1aaFSfzCg5M22EBl36ETh
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba32e2b25eed047ff2300e2c4899f3b2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ba32e2b25eed047ff2300e2c4899f3b2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~sfx003E007AC9\Cheaters.exe"C:\Users\Admin\AppData\Local\Temp\~sfx003E007AC9\Cheaters.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3dc 0x4681⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD531bf270dfb65dbde8f22850f36a68d65
SHA17540f99fd08eca37058f01189da24841be9ea227
SHA25618a1de89312eecd5c007738bfc2f278502caf2556547730ab7b0eff503eb8e05
SHA512d150837e5060f2dd5512d2ac7fbef86e77ad95a76a9867466bf908a72ba51a4788f5b79199c30f136718408ff30382b7d30a2db76be6c14868ff6ef52ad8b007
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
204KB
MD53864e6338242e5f886b16873c616fead
SHA1053b8318310f902728a7964b2f92db55d06bff6f
SHA25663140419dec5a6f37553c2318efe69eaa3f04ed5a79418bdb377820aba471109
SHA51289ed7dcdebb944a58cff365331465fa0c0c79dce8e37ba23fe473e1c85de79bbfa9ebb81e4142e3a7a85995cac1072dc81acfa4bfd504ceaa3cd6c8de4ab8651
-
Filesize
327KB
MD519afcfb846388b5fd9250a0eced26b7a
SHA19199369aa6037441b62bbeca1e52a333399f4fb4
SHA25671a17e0905ee712c3f5cbec5ad6339245969530358db049f7de2bb88754f28be
SHA5128616581632867d60fc158fcfeb12caae1f7ab021f9677618ee574ea27e56a63a037c7c4ab9cd83e910985cb232e47cf45b8294286f394c7cc991b191653ce5c5
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB