Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/08/2024, 19:25

General

  • Target

    c97960cfb1a8ddca53f33a4c12ca9b2f_JaffaCakes118.exe

  • Size

    784KB

  • MD5

    c97960cfb1a8ddca53f33a4c12ca9b2f

  • SHA1

    095cfb8ac5f3f98f12e507cebc3179a80f9c470b

  • SHA256

    708545763a6f8f9f7f5724a83b27363951e9fecd7d5f81bc7644193b63676ce5

  • SHA512

    a3b5162874a1ade4df08f6517858455895c1939cca189b3961754bc831543512e4db16b75ecf1dd425cbaeee120fd821019cf6af6af338a55f98e4e635de82b2

  • SSDEEP

    12288:sobDXJmz3CAQLy7tq4v/GQej4nNTovQ0f0YKVjvvQW+kPIOFCgYMJI+:sobD5s3Cu7CBjw9oVfG6LyrFrJ

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c97960cfb1a8ddca53f33a4c12ca9b2f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c97960cfb1a8ddca53f33a4c12ca9b2f_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Users\Admin\AppData\Local\Temp\c97960cfb1a8ddca53f33a4c12ca9b2f_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\c97960cfb1a8ddca53f33a4c12ca9b2f_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of UnmapMainImage
      PID:3552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\c97960cfb1a8ddca53f33a4c12ca9b2f_JaffaCakes118.exe

    Filesize

    784KB

    MD5

    1e8943c621c1b6a15fa87487bf63d540

    SHA1

    678a9bb000bbd0ce3491c030165adaaab8326348

    SHA256

    6adec37fbeeeac25adfa4076b1d669209b6e24ee8d78dfb16435ccdce0f39fdb

    SHA512

    07cbb1765636a05c03c727433ee052bf5b40f42d4df07cdc99c198c1ee70800da19f5256500bcdb5aad21cff521f30827eba6ae4ef467cd2971ef478f3bb2f7d

  • memory/3044-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/3044-1-0x0000000001A60000-0x0000000001B24000-memory.dmp

    Filesize

    784KB

  • memory/3044-2-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/3044-12-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/3552-13-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/3552-14-0x0000000001720000-0x00000000017E4000-memory.dmp

    Filesize

    784KB

  • memory/3552-15-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/3552-20-0x00000000053A0000-0x0000000005533000-memory.dmp

    Filesize

    1.6MB

  • memory/3552-21-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/3552-31-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB