Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 11:29

General

  • Target

    bb8c2c5073d9545a500df6e0b975a1e0_JaffaCakes118.exe

  • Size

    11.0MB

  • MD5

    bb8c2c5073d9545a500df6e0b975a1e0

  • SHA1

    3d57fa3056352741597accc80be0305418da8fad

  • SHA256

    7393f8fce342f0ba35858e73dfb8c3929174bf219c351d38a6a69d7c868ffb4e

  • SHA512

    655a5ed83207b67f3946f190c86bb2ac007e278914d1faed381a731c54b67c29e98cd2f3b555e5a6eb323425424a2615d9319b6400e9740d6a34bb4f62450661

  • SSDEEP

    196608:kyN2e9zg6ltlyuZp+tgidiKPjSM8tO4vbuertG3AABoeQZIMO612us8KeRkx1f36:kysojlVegidXPd8tbjVadKe6OG23RN1C

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb8c2c5073d9545a500df6e0b975a1e0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bb8c2c5073d9545a500df6e0b975a1e0_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:208
    • C:\Users\Admin\AppData\Local\Temp\is-CLVOH.tmp\bb8c2c5073d9545a500df6e0b975a1e0_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-CLVOH.tmp\bb8c2c5073d9545a500df6e0b975a1e0_JaffaCakes118.tmp" /SL5="$70050,11116972,52736,C:\Users\Admin\AppData\Local\Temp\bb8c2c5073d9545a500df6e0b975a1e0_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-CLVOH.tmp\bb8c2c5073d9545a500df6e0b975a1e0_JaffaCakes118.tmp

    Filesize

    686KB

    MD5

    e72a086eb6ae90ebcf93d057a39eed6a

    SHA1

    8d3808d0f5b3953d377c47200e719cbc49c08ab0

    SHA256

    c0fcf5409d5f937962b33c027b004402b1c79a9e899fa0d30371e13767cd9eb5

    SHA512

    8f3f8c8ea866b6e6348e588ed9aae1b80d685aed421a47077c8f6df65f2427fb860b394e49b3fbea228c9a806a074fd94cb5b69bc3d33cc0579def08bcbf66f0

  • memory/208-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/208-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/208-17-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4600-7-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/4600-18-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB