Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

fa1046c72d...18.exe

windows7-x64

10

fa1046c72d...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 08:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe

  • Size

    124KB

  • MD5

    fa1046c72dcdee73813acebf3fed9926

  • SHA1

    deb9db098512d200f78f05997945dadbccdd9adc

  • SHA256

    057281d1d5b33a0f0c43c8ca4b9da8469e70221526f5460c7f3b05f2af485244

  • SHA512

    adc5f6bf3c42fbbc124f179ff386608b64d9bc09b36cf4e69fafb7651eb511c1f67e53ced62570e3d73b64eb5f0dc6ec0f7ec4933ecccc095d06a5e1f8dcdacc

  • SSDEEP

    3072:aaAfUEihXRCrQKGcNqnGrD6uvIepyJS6f1qre6:ahfiGrQKGciwQJr

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 51 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Users\Admin\xeuwea.exe
      "C:\Users\Admin\xeuwea.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\xeuwea.exe
    Filesize

    124KB

    MD5

    9a666e0d6f1d81429978e2de150b9e17

    SHA1

    5c3145028b619ed5664901fc9315c5f102cfcef5

    SHA256

    83c12acd48123ce3cb90bc6870fcc36a63c18a6022f113077e96d7fd57970b4c

    SHA512

    6844b7eed041c18929c206d4fcd561739c7e7f8627c2c4e50efba7b4c9506e85a79fddd3f385283b27078771abc973a40133c2ac90173911ad1544975a47026b

    Download Submit