Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe
-
Size
294KB
-
MD5
1694dfdee136a7cc87b3d1b80092bb38
-
SHA1
7177715cda51f3c59220c8e4c502b2f882c1c472
-
SHA256
bfe80987b5ec031b5d4cdf89a2b6f296e9387132b12d35be720558959c5dcaa7
-
SHA512
2f3084eda05d6b6ab60987ed7417e15e25cf2c2e59142c96078cee1a44d4af5c4fef1eb659329c311d7e41ccd9d1820a2cea48a962aad0e2f70072b531e8479c
-
SSDEEP
6144:AkGd1DZxlWelOlMVDrcuJSsT4/ZOrss40AJq5aGI+MZX0RoeVJEmdX6P:AkGd1XlHlOqVncoTM4ssSJY3I+fVekKP
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 2716 1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe 2716 1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe 2716 1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2716 1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe 2716 1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
267KB
MD50088a8b8a6bdeee89b3a7e17d01da6e4
SHA1f0d46b59379c79c27ac5a38cb67740433f36614d
SHA256429e4259ae65713991bf882507477768cd2adb14bca6f8191a4a31cefb3a7b24
SHA512c8102dc9357db70ce0c2f7fc908bc32883576c007616dd5a297029edd115ffcdb756ef4c39d8c7cc274188ecc4d69d2be2470c34aaa4cc76d2da2e2003f1e81c
-
Filesize
205KB
MD595dea87b4295317b6aaf85ce56c4f57f
SHA134d54e4dd7cd1a18754e54d0bd83880e41d155cc
SHA2566db25bce80d2b8916438d09595a3bf443b146b5b49b22eef2f2478a95ea716a2
SHA512c46af29d20994676f078996febe8141abdf90e96fbac8bc609aade8a49d5bfe51b027ac0f3e952f8393cdc9a2bec7855b199e662506883b356837f7f5aa21c72
-
Filesize
42KB
MD566e0d3cb3825b658880be576875795bc
SHA1740982ce3b3e4bd08c1cbd5fc8cfeb982f1d4e05
SHA25627b7921fbbd360bf77db65a50b2cd9a600e6baaaf77fd60eee74476d9fc6c7e0
SHA51223873b2052f66d3b5961cfd5ca26d4d3f507cbd0317116e6b773d23defe47c164e1040fb56392f17cd2644528c64dfbfdeccc46e1965a650786414c8f8f74c7b