Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 03:53

General

  • Target

    df71085c253075b7ec9474348d576427_JaffaCakes118.exe

  • Size

    599KB

  • MD5

    df71085c253075b7ec9474348d576427

  • SHA1

    cd8824a2ad94939ef74bc22f3a2d9b727ff48879

  • SHA256

    cfbce9cdb3fb56d180a939250fe3dd410c3c9fa9143345d5fc9e2f326450bbb8

  • SHA512

    f52968904e767557589529eceb254c9e15974e96f3e1cf498e2434155a592dc0083c30c9313ebc28ed02d791441ec240d5bd4d19bd330df121099a346b0c26db

  • SSDEEP

    12288:JFu9j+SzSbK4I4P12bgWwrYAa/qVZsvsAXdMghiG:JFu9j+XI4P1SgWwrYjCUvsq+vG

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df71085c253075b7ec9474348d576427_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\df71085c253075b7ec9474348d576427_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Users\Admin\AppData\Local\Temp\fractal-mandala-screensaver-3.0.exe
      "C:\Users\Admin\AppData\Local\Temp\fractal-mandala-screensaver-3.0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4068
      • C:\Users\Admin\AppData\Local\Temp\is-0N7UC.tmp\is-1K7K9.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-0N7UC.tmp\is-1K7K9.tmp" /SL4 $60224 "C:\Users\Admin\AppData\Local\Temp\fractal-mandala-screensaver-3.0.exe" 310213 52224
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\fractal-mandala-screensaver-3.0.exe

    Filesize

    548KB

    MD5

    257c2a2010e5212f1c1ab2ce0302b5f2

    SHA1

    6c1adcb7ec096a587e1fbe6032ec59fa1ea6f11f

    SHA256

    7124b33faadf6ddf9d21d24bb360ee5bf30fb85888abb4404b9c64fd713cf5ed

    SHA512

    c7c4cc95c277b3f1144250f988972a0f9c4bfb542c5ab3d0cadcf03fab810dfdd9db08399db002e89f849b796b9ccb38e6d745db9f68c6b5da0ffd62378da059

  • C:\Users\Admin\AppData\Local\Temp\is-0N7UC.tmp\is-1K7K9.tmp

    Filesize

    642KB

    MD5

    3c9f925549a51f9017e08a072332fa47

    SHA1

    1bff860e744467a58ef986b1016a4454844f5ad7

    SHA256

    1eb6ba689a47d91d01c9b3caa93daacec49c7b6daafb217678b9ad8f545c8ac2

    SHA512

    86112ec0d9f4254bceb0a576bc03e09384a15a4a5e94b08ca65ddfbc60d9d8d459885138c2644c9309ac86bca0b86d41c92dbc8ed23d7d381cdbeb2d7963ec18

  • C:\Users\Admin\AppData\Local\Temp\nsz853E.tmp\NSISdl.dll

    Filesize

    72KB

    MD5

    1611656f80b78236069906365be36264

    SHA1

    064f7a679d484459db3b1768a1b8a898ae788883

    SHA256

    721454186b5a04a5755adcc0b6ad1ea71b0a464d69b5a97529b36e44f6087d3b

    SHA512

    625a6fef59c720afd1c5e5dc91dd549b91dd8d9c7802bebf391687234c4845848a5644e5b16c1b358cd6a43a67a9443f0e080d04c0688c64ec38ac06beeb4328

  • memory/1276-23-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/4068-9-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4068-11-0x0000000000401000-0x000000000040A000-memory.dmp

    Filesize

    36KB

  • memory/4068-24-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4412-20-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB

  • memory/4412-26-0x0000000000400000-0x00000000004CF000-memory.dmp

    Filesize

    828KB