Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/10/2024, 20:38

General

  • Target

    251fc88ffb763925fc860ffde94cf9b0_JaffaCakes118.exe

  • Size

    356KB

  • MD5

    251fc88ffb763925fc860ffde94cf9b0

  • SHA1

    b1c31c6d2069c2fbb8830d331bf278a3348e1c94

  • SHA256

    25f714d1afcc851fe3761d40d639375eefc64bf03e7423d3d75de76fbd52c159

  • SHA512

    fb73edfb48a194b3144fbae984cc4dbaca340062ee4dc951e038f10b857a90bdec9bbdcd02c321bf53045519f486c74ecdedec7f65fc15862033475b439a94ec

  • SSDEEP

    6144:7vbx8O8A+buvc1zO7ySeIObnOY0o0MDJMR5VoIP2T4LWE9maZY:7/LoMeXAMCR5VoI2w9maZ

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\251fc88ffb763925fc860ffde94cf9b0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\251fc88ffb763925fc860ffde94cf9b0_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Users\Admin\AppData\Local\Temp\251fc88ffb763925fc860ffde94cf9b0_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\251fc88ffb763925fc860ffde94cf9b0_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3400
      • C:\ProgramData\I7sc5jyzS5JF2P\eOp2tdgqrHUH.exe
        "C:\ProgramData\I7sc5jyzS5JF2P\eOp2tdgqrHUH.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3472
        • C:\ProgramData\I7sc5jyzS5JF2P\eOp2tdgqrHUH.exe
          "C:\ProgramData\I7sc5jyzS5JF2P\eOp2tdgqrHUH.exe"
          4⤵
          • Deletes itself
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3604
          • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
            "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe" /i:3604
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\I7sc5jyzS5JF2P\RCX850E.tmp

    Filesize

    356KB

    MD5

    58b7bea119b837626cc42b60819f1444

    SHA1

    f2d1417792f68072087ea12787ba3ba99febc2f7

    SHA256

    d3aed88f32b5aee67bdbf017714e790d48ccd638aa56c5cd6cc355200853778d

    SHA512

    6a7477ae713c81292f1c078420f1d9597316da7862a0d104eb9c64e3ea17bb5c77a21ccefb5043bf54689393ffdeb7afff0484f7e359449b72533ec6dc59273b

  • C:\ProgramData\I7sc5jyzS5JF2P\eOp2tdgqrHUH.exe

    Filesize

    356KB

    MD5

    251fc88ffb763925fc860ffde94cf9b0

    SHA1

    b1c31c6d2069c2fbb8830d331bf278a3348e1c94

    SHA256

    25f714d1afcc851fe3761d40d639375eefc64bf03e7423d3d75de76fbd52c159

    SHA512

    fb73edfb48a194b3144fbae984cc4dbaca340062ee4dc951e038f10b857a90bdec9bbdcd02c321bf53045519f486c74ecdedec7f65fc15862033475b439a94ec

  • memory/2028-40-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/3400-17-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/3400-20-0x0000000077360000-0x0000000077450000-memory.dmp

    Filesize

    960KB

  • memory/3400-5-0x0000000077360000-0x0000000077450000-memory.dmp

    Filesize

    960KB

  • memory/3400-1-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/3400-2-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/3400-4-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/3472-22-0x0000000077360000-0x0000000077450000-memory.dmp

    Filesize

    960KB

  • memory/3472-25-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/3472-28-0x0000000077360000-0x0000000077450000-memory.dmp

    Filesize

    960KB

  • memory/3604-29-0x0000000077360000-0x0000000077450000-memory.dmp

    Filesize

    960KB

  • memory/3604-41-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/3604-43-0x0000000077360000-0x0000000077450000-memory.dmp

    Filesize

    960KB

  • memory/3836-0-0x0000000077380000-0x0000000077381000-memory.dmp

    Filesize

    4KB

  • memory/3836-3-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB