Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 01:24

General

  • Target

    eece878f87a68ffe933b692dcb180514_JaffaCakes118.exe

  • Size

    172KB

  • MD5

    eece878f87a68ffe933b692dcb180514

  • SHA1

    b1df176f4698c6df33fe8385b747999fbc103310

  • SHA256

    770583edab04e23ba8a99010580f280eccc340f5087302fb4ca0e8c257a340ce

  • SHA512

    62f539c95ac745645809310621d28be2db02d5e684ccaacb3fd617b086ea6802d7d36e7772534cfed59ac5d57f7f97f9d082288677beee94bcc9f89f25ba8211

  • SSDEEP

    3072:HV39eB8R8oSx/mOEAFIFR7N3ims2+9AhLOG7GQiCLMt8Xq/WL8mge/:Hd9hR8oSx/mOEAFIFR7NHl++hLOG7GQD

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eece878f87a68ffe933b692dcb180514_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eece878f87a68ffe933b692dcb180514_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:536
    • C:\Users\Admin\qaeugu.exe
      "C:\Users\Admin\qaeugu.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\qaeugu.exe

    Filesize

    172KB

    MD5

    95630572adddbe96a0ab9eb397f2b3bc

    SHA1

    176a9cd6e34d3cb5ced756f39ac8cb7f6885f6d9

    SHA256

    8b13f4102a4e16e2969f81b034f379db78621f7c8d73cd4752cac4ca7d87d645

    SHA512

    463da40ade9d521dffe572e2a4dcc7c10a41b713c1a1640b4ddc893beca525d404bcac8173fd6bf1c8bd2a31acc37cd612baea9073dea15efd8bd1519b471faf