Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 01:41

General

  • Target

    eed545a854ece23d746a0e6a89bc72d9_JaffaCakes118.exe

  • Size

    304KB

  • MD5

    eed545a854ece23d746a0e6a89bc72d9

  • SHA1

    0a271ecc7db5f0bf3151a455bac335b43d350682

  • SHA256

    cd3f9d23719231cd510b252746d34f798e6214132282b5d1c6107af281765fe1

  • SHA512

    6dc49d713e317d1f91b6abd7d554cf611111629cc250ce909537333d99f778a56fede14b5a3a1a98d9ba9531618e596e4b8bb4c5d8f60d89ab51142e3bc0a47e

  • SSDEEP

    6144:GA7TgGATIr4tccyvkhznX75wS5f8evpmu:b7ATIMbnwg4

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eed545a854ece23d746a0e6a89bc72d9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eed545a854ece23d746a0e6a89bc72d9_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\System\log.ini

    Filesize

    476KB

    MD5

    a8fc17684868e0b2e66b3dc3cd651481

    SHA1

    ecb258488657f4c208980043b56e23979483fbed

    SHA256

    ee26db27bdf46d58c0dfd363b511bf3d118c685ee36a9b508e47ee4710e2ad81

    SHA512

    6eb13387abc33d34e3c582bf0df31b66a61ef0a281cd205eed8f6f24547b31270502196f8f3794ecd653b9839661a03c9adb802258add01a06222bcd40927ec7

  • memory/2384-28-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2384-30-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2384-14-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2384-24-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2384-25-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2384-26-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2384-15-0x0000000002310000-0x0000000002311000-memory.dmp

    Filesize

    4KB

  • memory/2384-27-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2384-29-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2384-0-0x0000000002310000-0x0000000002311000-memory.dmp

    Filesize

    4KB

  • memory/2384-31-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2384-32-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2384-33-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2384-34-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2384-35-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2384-36-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB