Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    3s
  • max time network
    5s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2024, 00:16

Errors

Reason
Machine shutdown

General

  • Target

    cddd2be456bafd92c35be93a04ec9bcf_JaffaCakes118.exe

  • Size

    55KB

  • MD5

    cddd2be456bafd92c35be93a04ec9bcf

  • SHA1

    bfdbd7fc32e484f9de68167e2c9eee1badeaecf2

  • SHA256

    19db486122397a33896897e249034c7f9fdf4e967c9aa2942b39c22927a076e4

  • SHA512

    d40cdcee0797fb39c04c9417b0b71c1fadb3887ecd0fc7f0e7450269c3ed35d35649376c44cb07654e2530c1224348b51eac81cf71d3f4d407004ff1285295a7

  • SSDEEP

    1536:NPKDseV2udPipzVpQMHR3IW+bJ2qFtPj:c8udKpzVpQMHSp2Ut

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cddd2be456bafd92c35be93a04ec9bcf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cddd2be456bafd92c35be93a04ec9bcf_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:464
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C reG AdD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v 11494171422 /t REG_SZ /d "C:\Users\Admin\1149417142\1149417142.EXE" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4244
      • C:\Windows\SysWOW64\reg.exe
        reG AdD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v 11494171422 /t REG_SZ /d "C:\Users\Admin\1149417142\1149417142.EXE" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:3680
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 1149417142_del /D "cmd.exe /c dEl \"C:\Users\Admin\AppData\Local\Temp\cddd2be456bafd92c35be93a04ec9bcf_JaffaCakes118.exe\"" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Windows\SysWOW64\reg.exe
        reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 1149417142_del /D "cmd.exe /c dEl \"C:\Users\Admin\AppData\Local\Temp\cddd2be456bafd92c35be93a04ec9bcf_JaffaCakes118.exe\"" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1816
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c w.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1436
      • C:\Windows\SysWOW64\shutdown.exe
        shutdown /r /f /t 0
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:768
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa398e055 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:2172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\w.bat

    Filesize

    1024B

    MD5

    d373cbe9c2434c60dc8bc9f89ac92f85

    SHA1

    0248c8aa1be5757e49570e4fcf73397d6be53833

    SHA256

    19e4f1eb69c2b59ca2aaae1e8888a518ca64a0c59ad4b6402fc6e692ea0736d4

    SHA512

    6d7a800920a5647388c3e30904d1ed984ec2ed2ba154e90ca617cdfd83285c8ec194b5f50a1cef50fbc54896a2bdb47ff7458d9dcbe2d1ab373bc1bc65c8ae52

  • memory/464-6-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/464-9-0x00000000005C0000-0x00000000005C1000-memory.dmp

    Filesize

    4KB

  • memory/464-15-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/464-14-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/464-13-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/464-12-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/464-11-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/464-4-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/464-0-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/464-8-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/464-2-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/464-7-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/464-10-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/464-3-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/464-17-0x0000000002F70000-0x0000000002F71000-memory.dmp

    Filesize

    4KB

  • memory/464-19-0x0000000002F70000-0x0000000002F71000-memory.dmp

    Filesize

    4KB

  • memory/464-21-0x0000000002F70000-0x0000000002F71000-memory.dmp

    Filesize

    4KB

  • memory/464-22-0x00000000021B0000-0x00000000021B1000-memory.dmp

    Filesize

    4KB

  • memory/464-18-0x0000000002F70000-0x0000000002F71000-memory.dmp

    Filesize

    4KB

  • memory/464-24-0x00000000021B0000-0x00000000021B1000-memory.dmp

    Filesize

    4KB

  • memory/464-16-0x0000000002F70000-0x0000000002F71000-memory.dmp

    Filesize

    4KB

  • memory/464-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

    Filesize

    4KB

  • memory/464-28-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB