Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2024, 10:58

General

  • Target

    17ce2461cf41dc55fd1432dd9b461086_JaffaCakes118.exe

  • Size

    3.2MB

  • MD5

    17ce2461cf41dc55fd1432dd9b461086

  • SHA1

    6548f1d8eb93f7847d43de307c9fcf783983b042

  • SHA256

    b9968149cdedf77356e26d68d82bc47ac20d11a14763c026ec36b842850b4af0

  • SHA512

    93f725bd9d74da2191e2e658f6ac73df8da86bdfc371a8610f32bdc4fc19363b76802ac219ba2172abee3bb794c66fcbe3db932b8ecc17220ce32537de6b3add

  • SSDEEP

    98304:XbLB5a8V1wMQlFvacoQpOLVLTAr9PtganH9:rLB5lwMQwbL0kc9

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\17ce2461cf41dc55fd1432dd9b461086_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\17ce2461cf41dc55fd1432dd9b461086_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsr96E3.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    1e8e11f465afdabe97f529705786b368

    SHA1

    ea42bed65df6618c5f5648567d81f3935e70a2a0

    SHA256

    7d099352c82612ab27ddfd7310c1aa049b58128fb04ea6ea55816a40a6f6487b

    SHA512

    16566a8c1738e26962139aae893629098dc759e4ac87df3e8eb9819df4e0e422421836bb1e4240377e00fb2f4408ce40f40eee413d0f6dd2f3a4e27a52d49a0b

  • memory/728-0-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/728-10-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB