Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 10:37

General

  • Target

    bb62d35229a9b9df9b150aaf18c5c507_JaffaCakes118.exe

  • Size

    271KB

  • MD5

    bb62d35229a9b9df9b150aaf18c5c507

  • SHA1

    83fb7d5e433b4958fffb575460d0f9ac2dfb1bb5

  • SHA256

    6a1f2cdc690339de2b1ab2c0f6f9dc2bfc0acd50e27453bde224617d9f12f30b

  • SHA512

    7b4877870a258c732b8b1102d04c3ea7b904b3e2f916cad7c847b5c528b8e874d81e155af18b87af3ee1ca20313ebc07fc6a7e5e51acc662180129c85526cd50

  • SSDEEP

    6144:gBs9f60yLtSVtikx0OKXfr4RI8TtLH6QC9LvBB2sq3q9vkkx/vZz:gB90iSJxbKXD4Rb6SVkx/vt

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb62d35229a9b9df9b150aaf18c5c507_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bb62d35229a9b9df9b150aaf18c5c507_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:4428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Tsu-114C.dll

    Filesize

    266KB

    MD5

    1c621f6a52f814921b9b42156b63f8c9

    SHA1

    6f0f75cf627075eee134f9a9ccfee26203800cee

    SHA256

    44c4e0d5b3686153c7647087a61972a010ba7e19b61cdabe801b1004778b9c36

    SHA512

    60425d4ce7f8b57bb3701c3f883b8a18e7cedfac723d5fb13d1aa6624057981555d8812ab50a785138d4fc0312f1da8f516b658c0230b32b211eedc2c754ac16

  • C:\Users\Admin\AppData\Local\Temp\{96EA72CA-4D51-7E63-9C88-05734D09503C}\_Setup.dll

    Filesize

    171KB

    MD5

    f1eb5e3ecdc132c1ec3e815cf2f7fff2

    SHA1

    e24fdc9854b08ec7b63f866b318fb0efe1f4f8c3

    SHA256

    4e47a6b5afbc4d96a0008a427ae31a602c12f0453aeff48ba59667d58a215e19

    SHA512

    5f617a8815d40972b920d004f09a3a92ae925b9e2aa05fa2dce5e85db7ab2e1a75ee7386020a34ad224eeec496320071f402e6bcf23ffa0adf62d9e1feac049c

  • C:\Users\Admin\AppData\Local\Temp\{96EA72CA-4D51-7E63-9C88-05734D09503C}\_Setupx.dll

    Filesize

    28KB

    MD5

    228722b118082a17ea16789d2cc38ee1

    SHA1

    4d840f5eea2a71ea27f60fb235145a683650da80

    SHA256

    591c3695f1c11acd7f2d67b449bbd10f6a72457f7a27146c26ac4d79ad5b37d2

    SHA512

    a1cb62594c03e0832b0b671f602ca45deb059a326a176b8e6d294da490f61e7972a12447c41bcbb5da163a544e9a1160043b29866383131f8e6574ee13592dc8