Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07/09/2024, 04:19
General
-
Target
d10f3e52e0170d2ba634bdcfa9ecb43e_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
d10f3e52e0170d2ba634bdcfa9ecb43e
-
SHA1
41f0d67afed5c0838ef0adb047c34875ec80c5b0
-
SHA256
6f2642da0cee6e4ed6866607761f92effdcf21171a0540abbe519732eaffdcf7
-
SHA512
bcd18abc261ea0382656610ba42085bf184c5faf8772cf7bee9b279185eec9bb1a0a52509ff0c1cd3b9279a1cdca329dba41649d9d262f032f1ec14132731228
-
SSDEEP
24576:6ArW/8hh0FQAq7c8nA7YMv3+DpBNPRI9ovlG4XozaEhptdPYfCG6bYVxXNVD8pVv:6e0mfW3YNPRRlG4saIprQNy
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d10f3e52e0170d2ba634bdcfa9ecb43e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d10f3e52e0170d2ba634bdcfa9ecb43e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD52004bcee923b0e0222f4cab87c2c2a3d
SHA10a3c122b7cfe403403d913ecc1b328480b1bfc2a
SHA256f92f08df2b65e2f5b5db141c99b098c8b077c0c853a1fd51bfcc6d40dc68ad77
SHA512cae47a4dfdb942622ebca65d57e9d80c29cb299aa8c217983e34a51655c2e96ed26c7fa2fad978b6279ed4d3c8c0571e417c60152bf66a116f67d0fe38d6a445
-
Filesize
735B
MD541de862d61a3e071cd3050e2eadf59ab
SHA10ac21f7a7dbb9e2ba601ba84ce4d0ba86cf119d1
SHA2561e46176cab0c32ed1b78663d61c1729c6d1a7bbc79f02cebb604c0de1109c844
SHA51265ddafeae0ad19104a342efd2b77a064736ea796a2d9f802f6081e55e6a2d383990f5e8a8558257cf8c9a905fc1baa2bf8efba7db802555a788abc36f80461ba
-
Filesize
1.1MB
MD523f637a3810959f3cab1406b9b0904bb
SHA19d3e0c425c156c72e167a07155066880566e649f
SHA2561d02e25a23156be13afa686f1bb5437ce9591f02c985a9f1028c895f90ba72b0
SHA51283b66add76ba76a5ca6fc95f01c5d19a9758dce475d87f0da065d769e661b7d01d3b848164cc74f824aabf38c64a79af927d6deb47558153010b949386d8fd53
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB