Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 06:05

General

  • Target

    1223faf11f922b235b6992e47d90fcd2_JaffaCakes118.exe

  • Size

    150KB

  • MD5

    1223faf11f922b235b6992e47d90fcd2

  • SHA1

    8743beef1b6fb364f9f3eb45154ebf53ed9fd6eb

  • SHA256

    bd3cee9d8f3d92c81a36ff0276ddc76eb9974a8dbc2ea7293e2f60308a2da8f4

  • SHA512

    0dd48e526b6f4d211fa86737254174369fc405a235170b30d5b44439d9a17d8660028eeee410153995a4ecf62fd384bb28899aa2ff4177de116c284f7e7620ab

  • SSDEEP

    3072:6ZMJnTeM4cJJ9MsTacAfXzYyL5UP/wqUpKnN3meex3K89FyouDxxY:SeTeM/5MsTac0zYydUP/+KN2ja89jYxm

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1223faf11f922b235b6992e47d90fcd2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1223faf11f922b235b6992e47d90fcd2_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3604
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4456

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsmBE11.tmp\KillProcDLL.dll

    Filesize

    32KB

    MD5

    83142eac84475f4ca889c73f10d9c179

    SHA1

    dbe43c0de8ef881466bd74861b2e5b17598b5ce8

    SHA256

    ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

    SHA512

    1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

  • C:\Users\Admin\AppData\Local\Temp\nsmBE11.tmp\inetc.dll

    Filesize

    20KB

    MD5

    134b93f8bd1f82cd2f1b06c878580703

    SHA1

    29cdbce7a2caf1f7e4d2a139c42336d490074665

    SHA256

    45153adf50541316468e2b189a0f8127be9fb29e2f920e7eeaa6aceb438db8c4

    SHA512

    f970c38debb6631dab7369e2bc96237f16a8fd328d9d35a2b54cb688e1807f62cc6d63230afe89ce5c3945097ae4466872c72929a9623adde3ee57bddf54b692

  • C:\Users\Admin\AppData\Local\Temp\nsmBE11.tmp\xml.dll

    Filesize

    118KB

    MD5

    42df1fbaa87567adf2b4050805a1a545

    SHA1

    b892a6efbb39b7144248e0c0d79e53da474a9373

    SHA256

    e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845

    SHA512

    4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    150KB

    MD5

    1223faf11f922b235b6992e47d90fcd2

    SHA1

    8743beef1b6fb364f9f3eb45154ebf53ed9fd6eb

    SHA256

    bd3cee9d8f3d92c81a36ff0276ddc76eb9974a8dbc2ea7293e2f60308a2da8f4

    SHA512

    0dd48e526b6f4d211fa86737254174369fc405a235170b30d5b44439d9a17d8660028eeee410153995a4ecf62fd384bb28899aa2ff4177de116c284f7e7620ab