Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 04:29

General

  • Target

    0ded0b74c3021cf741c9639f1ec2ac02_JaffaCakes118.exe

  • Size

    5KB

  • MD5

    0ded0b74c3021cf741c9639f1ec2ac02

  • SHA1

    3630ed39035c1e3343a8aa87e17a1cf65410f61d

  • SHA256

    18ed2296e8b35c5d91d5d65e70b2cb80830563bd0c3b8222ac5171a7cc842f05

  • SHA512

    0a3c67274b9ddd4dfe2e2acfe6c4dda9f901fa7544d23ab9b45eecb3696cf3247ab717eed36a491298e338dd7fe4dd9b9a07f3cefe4a21183de6be6407ca4365

  • SSDEEP

    96:R+MQUs5A0j4EqojhfUA2GRu6oTOPKC+Ce362uzbCw2OyTXjTemZ:R+usu0ZVunVJx62uzpUXffZ

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ded0b74c3021cf741c9639f1ec2ac02_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0ded0b74c3021cf741c9639f1ec2ac02_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3448
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://www.placeforporno.com/
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3700
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.placeforporno.com/
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2960
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:17410 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2136
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\n.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3308

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    823fe1de5451b6ea9c69599b131233db

    SHA1

    af8b9b46bbe4b0b996abc996cc5f000f8c498348

    SHA256

    a13b5fcb02fe68cd72e236cec1284e80ef9aa37bcbb596f57fa0d32f9bdb5a32

    SHA512

    043c555804f19aa482e5419fd0a27b3cf3ca5369cf4f9941608358a7cca8f524515041881b35af63b02dd915abca4a51f45c2b60f1070a293b652d6fbe3ca782

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    c5bbaa3bfd2efd89f32326a71012880d

    SHA1

    0557015cc4787066f12db6ba63203b550efcc0b2

    SHA256

    dae44efc7ed26d26a6c4ef78b0e282d02ac4ef4dc1c9766abdc24722e6a03f32

    SHA512

    d4a4b8155829394f6b6b14b23a5baf432904941e2dc80dc0db82b087b9367418252f2fded1e928ba4e4ed44a83a37aabef01d1111bf0e0526914a5b0e32b1340

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TBBQW6D\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • \??\c:\n.bat

    Filesize

    219B

    MD5

    0700476e041cddbcf5435d41a711c439

    SHA1

    489c0115a954d23a8082f1e12ae378b1735cb37f

    SHA256

    7a3734b451c854ae9702995f09025becd1f867fcd94220d68a04fae662113fa9

    SHA512

    0df5059c2ea40d9f9d46d5f6ee0e04e9337cecad94747416dc6e131c9d49f6f97366c2d0f2ea2cb8db9aded00ea6396545df3b8a06777976698a7eeddd7c805c

  • memory/3448-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3448-6-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3448-9-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB