Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 05:52

General

  • Target

    d1386a15b89e14bdfcf4262857603596_JaffaCakes118.exe

  • Size

    92KB

  • MD5

    d1386a15b89e14bdfcf4262857603596

  • SHA1

    7b008ebac861c1ba141eaff3090a3806405e6474

  • SHA256

    f51fc2e266418e158642a64ab4c8a7a246d90520de1e7bc119a6e8bbde989ae3

  • SHA512

    59f61c6fa4bc5e805097de7f70810864fec4a31cdbcdb949dad1b41930358c8fb34185e1a173619d699a7653b68f14526c50261e0b1ff4bdf5da23532f474679

  • SSDEEP

    768:g9/OG/Vbv2gV99m+Yhnvo29b3fnN0zsROESLkKpyB69vgW:2OGp2gTV4ZbPn2zsRO/aB69

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d1386a15b89e14bdfcf4262857603596_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d1386a15b89e14bdfcf4262857603596_JaffaCakes118.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3580
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\F107.tmp.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\F107.tmp.bat

    Filesize

    207B

    MD5

    e75c78d447860e3e26de77644afc14a5

    SHA1

    948b5d9bd43ab443de29277e2b1f11b6f3f26714

    SHA256

    a6ef392374c076fb342f179f1acdce382ea00ec99ade81dc4812c5c42b80c3c5

    SHA512

    d7af59a29c3c193e1d3652ec5cfa200b17bdfd5a3d4e47060eaa7077586607797a5b25a70c965f75b00b7b0dcda439b83043b268c54fd6d27e01daf1445bd4fb

  • C:\Windows\SysWOW64\uvjbclsk.dll

    Filesize

    2.4MB

    MD5

    adaf9c03b3b8d864bef0fa612165bb7d

    SHA1

    14c61539a83bb00c7fc86f0bdd2f20c4e8c2ff5c

    SHA256

    837ed0886223837a743ad2fb7fc0c38bf679d9cb09d554d5c48f7985eb8c2812

    SHA512

    3d96ce52fd64224e495878ed6be6f6eeb4fea33aad6904cd2b841d64f96e787c1a5fb628cd8ab7b500895f5c1fbf2b3cb36d388aa992cc2fa93023a303f95d24

  • memory/3580-6-0x0000000010000000-0x0000000010009000-memory.dmp

    Filesize

    36KB

  • memory/3580-11-0x0000000010000000-0x0000000010009000-memory.dmp

    Filesize

    36KB