Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/08/2024, 13:27

General

  • Target

    beb006d6487f75d6b4048ebc8d5e4e55_JaffaCakes118.exe

  • Size

    112KB

  • MD5

    beb006d6487f75d6b4048ebc8d5e4e55

  • SHA1

    4b610aeaeacf9e5f0acbe24c6efd9fda7c21174f

  • SHA256

    b208e2e3166a4b3171c357b5439c10192524f91e268ad346e57e513c76e7513f

  • SHA512

    cfa9acc32a6d0ea208cd70939d94834e827dac6a6ceb27cb19be6eca638028657a119a14b4250101234137cddcc792a2daafee6a74834e4493a268a4de12b161

  • SSDEEP

    1536:fQpQ5EP0ijnRTXJC7NeYRNgKJ+BCyECdkgrQ3yCc+08+FZ7mKFvWROPdv6Nk:fQIURTXJ8eqgKJ+BCbCugrDs+FZ7i8l

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\beb006d6487f75d6b4048ebc8d5e4e55_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\beb006d6487f75d6b4048ebc8d5e4e55_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:428
    • C:\Users\Admin\AppData\Local\Temp\nsoB6DE.tmp\downloadmr.exe
      C:\Users\Admin\AppData\Local\Temp\nsoB6DE.tmp\downloadmr.exe /u4d48823a-b8b4-4f4d-b72e-794a5bc06ebe /e2075659
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:2164

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsoB6DE.tmp\downloadmr.exe

    Filesize

    137KB

    MD5

    bbf2521f0924f66c7bb0d63cae2af0ae

    SHA1

    e8ebec5f73a4fa3c513611aa6b97ea3759c5d701

    SHA256

    62fd49a2104878f136e2247037c5ef9a73f6a78c4ca3a1cc38e1bfb80b108021

    SHA512

    0e643b8f2494acb366a030d33152eabe8c692ba3a39bb674ca9ff7f78f8f537d22110e613045581472003ce0d4f831ff487ee3e71b06635eee46a9b6a3fa4991

  • memory/2164-4-0x0000000074D42000-0x0000000074D43000-memory.dmp

    Filesize

    4KB

  • memory/2164-5-0x0000000074D40000-0x00000000752F1000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-6-0x0000000074D40000-0x00000000752F1000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-17-0x0000000074D40000-0x00000000752F1000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-18-0x0000000074D40000-0x00000000752F1000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-19-0x0000000074D40000-0x00000000752F1000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-20-0x0000000074D40000-0x00000000752F1000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-21-0x0000000074D42000-0x0000000074D43000-memory.dmp

    Filesize

    4KB

  • memory/2164-22-0x0000000074D40000-0x00000000752F1000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-23-0x0000000074D40000-0x00000000752F1000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-24-0x0000000074D40000-0x00000000752F1000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-26-0x0000000074D40000-0x00000000752F1000-memory.dmp

    Filesize

    5.7MB