Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 14:09
Static task
static1
Behavioral task
behavioral1
Sample
0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
-
Size
1.6MB
-
MD5
0624c43699e11e05e7f784bebcf17768
-
SHA1
9058c4eaad185dd7b22a67198f51baa6b4f13cb0
-
SHA256
94cb5e84212a6353fd3386f2d83f5b864c64f4bd3207eff718a843d172011a1f
-
SHA512
4a40fa2bba990473d32abadcf88ed62f15790668d9b556e3a13994fd60a0194c762ea68c276a35f6923d72cd23e587fb0caddf62611b950edf09db2a1a57dce1
-
SSDEEP
49152:WQagM/VkLHwbwexxcTcoOfhc8AxOVnbw+ij/TtCUjnbIM:ZEVkLAxPo0c8hB9ijnjbJ
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1812 0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe 1812 0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe 1812 0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe 1812 0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe 4844 0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe 4844 0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe 4844 0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe 4844 0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1812 wrote to memory of 4844 1812 0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe 82 PID 1812 wrote to memory of 4844 1812 0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe 82 PID 1812 wrote to memory of 4844 1812 0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_e9151d90"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD5d8d2e91332c7d80f74c2c88eab43d854
SHA1c75964341fbf593637d3aef581810840d5286935
SHA256573f9a8e2bde40245c58f722286ca0d60901ff8abf3471b981d6f513e987dad2
SHA512e1a51f805cfab92790cd51057f553afa9aecbb329d5dba054e1b5d6b4e022ae7403e2e0ce0a82a7c8f4902417fa34020844a39a120696d1c2b6ce7a354fdb21e
-
Filesize
692B
MD544601e00ff712607d2a0b64de786d843
SHA15696d1604b564a38669035faf395f78c933d8717
SHA256424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9
SHA5127328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1