Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 08:05
Static task
static1
Behavioral task
behavioral1
Sample
0eb62dc4fcb05cb49e426330725ddb4e_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
0eb62dc4fcb05cb49e426330725ddb4e_JaffaCakes118.exe
-
Size
188KB
-
MD5
0eb62dc4fcb05cb49e426330725ddb4e
-
SHA1
e5f0b2b867cefd2f4e8cbda250bde12701b75bbf
-
SHA256
9487e25d73ed33232d8947d41fb3fd0336934852564bee67159a67a4d93aa489
-
SHA512
7b6a4b56d4d434d2effc9d658166dfc9e8adced7c54052ca8b204112b99016cc66766fe804f11430e00e8c6c09091447eeaf5eea6cb7bde878b1e190f2ace383
-
SSDEEP
3072:hn1/uEAgDPdkBlyFZ+ScjaiKWbETBquAEXlqsUU64Qd/aQeRgpo2FbA:h1OgDPdkBAFZWjadD4s5/QczRg7FbA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3004 5062ba7e8e220.exe -
Loads dropped DLL 1 IoCs
pid Process 3004 5062ba7e8e220.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0eb62dc4fcb05cb49e426330725ddb4e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5062ba7e8e220.exe -
NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x000700000002345b-17.dat nsis_installer_1 behavioral2/files/0x000700000002345b-17.dat nsis_installer_2 behavioral2/files/0x000400000001db78-51.dat nsis_installer_1 behavioral2/files/0x000400000001db78-51.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4272 wrote to memory of 3004 4272 0eb62dc4fcb05cb49e426330725ddb4e_JaffaCakes118.exe 84 PID 4272 wrote to memory of 3004 4272 0eb62dc4fcb05cb49e426330725ddb4e_JaffaCakes118.exe 84 PID 4272 wrote to memory of 3004 4272 0eb62dc4fcb05cb49e426330725ddb4e_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\0eb62dc4fcb05cb49e426330725ddb4e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0eb62dc4fcb05cb49e426330725ddb4e_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\7zS5DA1.tmp\5062ba7e8e220.exe.\5062ba7e8e220.exe /s2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5a724dac649142fef71fe4b529684e969
SHA1e2878e84886ec53a1332ad969a825062526b5cd4
SHA256b58c58b5073034d74c5d93902bbb9d402be063e907bdf77115b55bbb99af21dc
SHA5129f475ad52fa2b7f82e74df87c02e42f937b5e3b62773b7d51cb53facfcc8b4934ad3c2fc21496cfabaa4dd103a309ed5cccad1ad3d6037f6c4f3a540e3e9d5b3
-
C:\Users\Admin\AppData\Local\Temp\7zS5DA1.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5a07587a78e6331798bb060d9c3781f57
SHA1f0bfeb61c9fe4fdd7df6292789864dfa3f82c31b
SHA2564ff15396b2becfbee1ca1c1c05252cd640c6002cd5a59e2ab822dfc266e73350
SHA51273373b512e22a0ffa81cc050c87ec686842effa7fdcb2ed4f0692030f2b9c5777bcdf6775b4f6856b908ad73ab10ef1a23ea2f154dcb56760f2aa4d1b4d7cb19
-
C:\Users\Admin\AppData\Local\Temp\7zS5DA1.tmp\[email protected]\chrome.manifest
Filesize116B
MD5127ae21aa18dd73cb33faa0410499251
SHA12f21e0f865f3cdbf9d724051eeb4c1790819d6e9
SHA256f5beebc173c365d1c079fe6347538e88682a773427a4bf4ad476145b82e4d54e
SHA512523f78ba7a1a71480996f81ef1301a73c571a7af1d3c69127c094b383c84bf6ff0964f14f486ade5397400d7b0f5623ffbe99241d6412114be1f9cb4faf2e81e
-
C:\Users\Admin\AppData\Local\Temp\7zS5DA1.tmp\[email protected]\content\bg.js
Filesize8KB
MD50cabe0d68868eedd91640df7b99ceb79
SHA19fb60ca5a37f9956b0ba8bdd297ddef820684e62
SHA2561e32e3482693d946912a32510fbdf918973b5b4b027c6bbf95b13676b0569b55
SHA51230faa27ef05f67b992724260a4ffc3c9b1e94e320e7ccf65e6cd008433fe8f97c2c5ea19c7e9d2b467576b4208664c9d4e7f5edbe7c4de4ebe8910c570a61e77
-
C:\Users\Admin\AppData\Local\Temp\7zS5DA1.tmp\[email protected]\content\zy.xul
Filesize225B
MD5fa0ca10690431e996f8b0f9f87a92591
SHA1a261729e10f4a5859c74823530d1391cd48f8640
SHA2563a8159498b5a2c46e81556ef33d3418eeb949c41df91b2fb02d5af5140cee83c
SHA512b166e094cda9bb967cb75e606357a25a9a8ee2d4019520ea95fa384f226f330ec7794d7d6bb7eb94211b368f1f001614bc64b611af8465ebcca5c9c011f2e4bf
-
C:\Users\Admin\AppData\Local\Temp\7zS5DA1.tmp\[email protected]\install.rdf
Filesize717B
MD56ba9acd2359d21c0ed6131d48ba7e46a
SHA1809db4f73017a28e9155dc3740ca32bf533c9182
SHA25626dd1f4833b19d4888694ba0fa8a1b1d2a6e56a5cd11a59e92ce260ed334f212
SHA512a2bb0accfc5fdce90c15fa6c64ac69e8ec60c6b05513eea7ee065689977ec19ee95a98027d15a4b4bd521aaaa8211220ffb949344282f624baf98d1a36da75c9
-
Filesize
65KB
MD54ccf1a317aa8539c857835e4ebe9c806
SHA1223b73d09d7398f40aff3ccc569e66cae3886ee9
SHA2564529889c5575cd4e28b3691f0489c806442840292a9e459ada4dab3e024cc242
SHA512ecab68799b5a51c7d2a3735a9b3c17ba20a315618aa9575a5b02d5d4535716966031a26982012669f069dbfd8a6ab62f95737b7c402bf680f3a498900f627312
-
Filesize
7KB
MD56ba52ec18057f565047fc330dbbeefb8
SHA1ab93796f8491129a6ad61628c5b8dd50a7b11e99
SHA256e06b7b77d56e3a97d9bbfa872b7aae999bd02bf258a1c1b0b63cd621912274a2
SHA512cfe6dcf9e6937beaf0455323e0ef9d23a675b2e92d342913ec654ba00bad80584b94c56c1218ee003d06ed416406088d885429c8d87e7c6c26f98c5c11cf41b1
-
Filesize
640B
MD5436c0d3359f15c7cdb7719062a9bdb6e
SHA1c980ca115055664c85423e9271626ed23aa30bdb
SHA256fef517276e25102b64c0ede4b86ac23ad506a534a43923304f91280ba4c4a2c2
SHA5128d22cb813e700c95db23fb471b7a2587153571cb599198ecf648acf5c7f3fece22965d75cba19b6d44469c093ad427616ef5a5e885d212b371d037ee5214d9e6
-
Filesize
4KB
MD57579ade7ae1747a31960a228ce02e666
SHA18ec8571a296737e819dcf86353a43fcf8ec63351
SHA256564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
SHA512a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b