Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2024, 10:28

General

  • Target

    0578321729b1d442e350458365792b58_JaffaCakes118.exe

  • Size

    42KB

  • MD5

    0578321729b1d442e350458365792b58

  • SHA1

    1642eccc79d49086e24781957ad61bc1617ce3eb

  • SHA256

    b97dfc5e9713b05f1ce85dc7dd9a982af513b271eb06e0dd65f241e6bf75cf50

  • SHA512

    d9d79206c579a6ef1c21c6ae077b20124e86e2ef18be595dcf099b8db3fb504b16f3623f718535bfcf0cf14ac84b4ed33f91e59bc5f4723b285786d084b72059

  • SSDEEP

    768:dFDZ297K733ZL4OsPDsJOQICmcS7miUCbCB0ZOYirm3V1yoaChDl1F/oKaW7WXJo:oe18OyszIz7miUCbcYomLaoDHRJaW7

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 5 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0578321729b1d442e350458365792b58_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0578321729b1d442e350458365792b58_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4716
    • C:\Windows\SysWOW64\WmInit.exe
      "C:\Windows\system32\WmInit.exe" "C:\Users\Admin\AppData\Local\Temp\0578321729b1d442e350458365792b58_JaffaCakes118.exe"
      2⤵
      • Modifies firewall policy service
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:4868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\WmInit.dat

    Filesize

    8B

    MD5

    cb9b7eb6230efe62ef7303c050eab2ac

    SHA1

    656c9af78455b8fc87d336ace06ace7f0b357592

    SHA256

    6b06ef267c38d23fa4968cbcfc854dcbad32624da0a95c1d0040f22f04897fc3

    SHA512

    35004b74b3c632db92e21c82a192b90a1b60562af89476827d8863245de747d0ed1296540a5b4afa99bf7e9282f9445278283e0de156ec5d79b9564ac94dcd61

  • C:\Windows\SysWOW64\WmInit.exe

    Filesize

    33.4MB

    MD5

    5d0e24c9886692237fc6225d2d0b954c

    SHA1

    88e89edefa9b4eb895a78f48a7dd8d3c2fa50479

    SHA256

    cbe1457268fe8b94f652ae6d21da62e2fe96cd5eb02186069311a25f22c0db68

    SHA512

    c5d4ef20072d5816630fec5a90ccfb1ab83ab6f695f966a129a4701c78b811d5a78bdc46657eae5f6ec4686b1c14ec60eeaba844ed755d1ff6e96f0aaa5592c3

  • memory/4716-3-0x0000000000404000-0x0000000000415000-memory.dmp

    Filesize

    68KB

  • memory/4716-2-0x0000000000400000-0x0000000000518000-memory.dmp

    Filesize

    1.1MB

  • memory/4716-8-0x0000000000400000-0x0000000000518000-memory.dmp

    Filesize

    1.1MB

  • memory/4716-9-0x0000000000404000-0x0000000000415000-memory.dmp

    Filesize

    68KB

  • memory/4716-0-0x0000000000404000-0x0000000000415000-memory.dmp

    Filesize

    68KB

  • memory/4868-10-0x0000000000400000-0x0000000000518000-memory.dmp

    Filesize

    1.1MB

  • memory/4868-12-0x0000000000400000-0x0000000000518000-memory.dmp

    Filesize

    1.1MB

  • memory/4868-14-0x0000000000400000-0x0000000000518000-memory.dmp

    Filesize

    1.1MB

  • memory/4868-16-0x0000000000400000-0x0000000000518000-memory.dmp

    Filesize

    1.1MB

  • memory/4868-18-0x0000000000400000-0x0000000000518000-memory.dmp

    Filesize

    1.1MB

  • memory/4868-20-0x0000000000400000-0x0000000000518000-memory.dmp

    Filesize

    1.1MB

  • memory/4868-22-0x0000000000400000-0x0000000000518000-memory.dmp

    Filesize

    1.1MB

  • memory/4868-24-0x0000000000400000-0x0000000000518000-memory.dmp

    Filesize

    1.1MB