Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2024, 14:09

General

  • Target

    0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe

  • Size

    1.6MB

  • MD5

    0624c43699e11e05e7f784bebcf17768

  • SHA1

    9058c4eaad185dd7b22a67198f51baa6b4f13cb0

  • SHA256

    94cb5e84212a6353fd3386f2d83f5b864c64f4bd3207eff718a843d172011a1f

  • SHA512

    4a40fa2bba990473d32abadcf88ed62f15790668d9b556e3a13994fd60a0194c762ea68c276a35f6923d72cd23e587fb0caddf62611b950edf09db2a1a57dce1

  • SSDEEP

    49152:WQagM/VkLHwbwexxcTcoOfhc8AxOVnbw+ij/TtCUjnbIM:ZEVkLAxPo0c8hB9ijnjbJ

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_e9151d90"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\pkg_e9151d90\autorun.txt

    Filesize

    74B

    MD5

    d8d2e91332c7d80f74c2c88eab43d854

    SHA1

    c75964341fbf593637d3aef581810840d5286935

    SHA256

    573f9a8e2bde40245c58f722286ca0d60901ff8abf3471b981d6f513e987dad2

    SHA512

    e1a51f805cfab92790cd51057f553afa9aecbb329d5dba054e1b5d6b4e022ae7403e2e0ce0a82a7c8f4902417fa34020844a39a120696d1c2b6ce7a354fdb21e

  • C:\Users\Admin\AppData\Local\Temp\pkg_e9151d90\wrapper.xml

    Filesize

    692B

    MD5

    44601e00ff712607d2a0b64de786d843

    SHA1

    5696d1604b564a38669035faf395f78c933d8717

    SHA256

    424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9

    SHA512

    7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1