Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

1415517992...18.exe

windows7-x64

10

1415517992...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 16:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    14155179926713b5c2a9c61a1b89a055_JaffaCakes118.exe

  • Size

    32KB

  • MD5

    14155179926713b5c2a9c61a1b89a055

  • SHA1

    5e7b85c9fc39892974d68f1d2f4e9326660a40e3

  • SHA256

    d6975169935130df15684d2f21c6e12d5748f2423d4e18b92af88fbe9c0bb7dd

  • SHA512

    1681a9ffcb4de9baf8973f091d81bc57def6ff1dac5b0b90b5d6b1f02a3723fd2afbf6a9919a4e0037775eb14c6991e4f3674729b33f959ff91bafeba7541428

  • SSDEEP

    768:QhzsIdmoIBW+J1aLu+iANtg9bPHhHXPNWNCB+Gc1H8zHvc:QJsIdmoIBW+faS2tg9zxB+52Dvc

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14155179926713b5c2a9c61a1b89a055_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\14155179926713b5c2a9c61a1b89a055_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3916
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Admin.exe
    Filesize

    32KB

    MD5

    605da842bc162e4351b3aef58172f85a

    SHA1

    24fdf112fc6f133f48e1bff02c2ed749be8a4d37

    SHA256

    21852621cee0f4f254cfb58a3f42ef6bfd5e3618a5a22a65e63f539d43366b2c

    SHA512

    55f876c9757b432442002c5a5acb9d2b45284ece1b2b2e0e69c70306c8971d5778207b952712762db4a4555bea48eb73851c7762cd26b66ede7aea0451108d23

    Download Submit

  • memory/3916-0-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/4072-33-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download