Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2024, 16:14

General

  • Target

    f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe

  • Size

    2.8MB

  • MD5

    f6626e65f1eb82888caee56c3f658b89

  • SHA1

    8a45d192c080a0923cbc2757df086d34b39c63e1

  • SHA256

    41aff36e468738584879894efb4062f634c5bfe9c9300db8e15fe3f638f85f95

  • SHA512

    10ec80ec7db80e0c39f48d688a06ca3cde6c4dd37a26dc872967f3d663cc2dc2dd26d2211877c23e72f965189ab784fd851f0e45f3e2899ab96070957e5fa877

  • SSDEEP

    49152:2hUacRT39VIQfT3WUacRT39VIQfTzWUacRT39VIQfTfWUacRT39VIQfT:2hUzRjwQfjWUzRjwQfHWUzRjwQfLWUzJ

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\d0c5ac152f4348afb5bb7d5f6c508b2d.xml"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3368
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\d0c5ac152f4348afb5bb7d5f6c508b2d.xml"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3416
    • C:\Users\Admin\AppData\Local\Temp\f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe"
      2⤵
        PID:976
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 816
        2⤵
        • Program crash
        PID:4944
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 228 -ip 228
      1⤵
        PID:4208

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\d0c5ac152f4348afb5bb7d5f6c508b2d.xml

        Filesize

        1KB

        MD5

        6de1b33159e6c1e8ad0623dae37a195a

        SHA1

        2dc90fd881c260703196f00e488575ccb4bb1757

        SHA256

        9a303f8f55dac23c8026c379e9db7889b6dcdcae84eef224abf5b383d3f69033

        SHA512

        2306e3abf098c954bc4b1df40befbde3098d356f1aadae860b0c23556025eb5abdfef9408a01d43a3286739db3cb8b892a0607998fc222fb88e5d1acafd68c9d

      • memory/228-1-0x0000000000E80000-0x0000000000F80000-memory.dmp

        Filesize

        1024KB