Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 00:50

General

  • Target

    27fcf2b5cea97e7f0b46efc56c4e51d3_JaffaCakes118.exe

  • Size

    132KB

  • MD5

    27fcf2b5cea97e7f0b46efc56c4e51d3

  • SHA1

    3ed676010997f7b0784c3969a5e625ab8460fecc

  • SHA256

    e60164d938a58fb1cb736cd395dfa9c7db0126d4f3c326c48fe47372c9151f41

  • SHA512

    ba81363c7db6a5e84745702c7cb11d2273aab352110e6a09c12ffa102b27f0f80e2170881cdc869e7c7d7d132999e540c98332317205e1edbdeed755849f6660

  • SSDEEP

    1536:5TvlubSHe/jHLsh6LctKWH0gEtWTE/rli5Z1nWvjI4TWRtss+cfWAY+/Vb2XmzfH:5cbFvLctKWAW8AB8baRts4WNg2Xmav

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27fcf2b5cea97e7f0b46efc56c4e51d3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\27fcf2b5cea97e7f0b46efc56c4e51d3_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Users\Admin\AppData\Local\Temp\27fcf2b5cea97e7f0b46efc56c4e51d3_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\27fcf2b5cea97e7f0b46efc56c4e51d3_JaffaCakes118.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Users\Admin\AppData\Roaming\Microsoft\taskhost.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\taskhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4404
        • C:\Users\Admin\AppData\Roaming\Microsoft\taskhost.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\taskhost.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:3936
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 256
          4⤵
          • Program crash
          PID:4536
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 304
      2⤵
      • Program crash
      PID:4728
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4260 -ip 4260
    1⤵
      PID:3648
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4404 -ip 4404
      1⤵
        PID:1876

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\taskhost.exe

        Filesize

        132KB

        MD5

        2da321ee2d987b5219b158a60d299398

        SHA1

        cde2d2937299dc5c177b183bd5c531695f90c215

        SHA256

        e7d9b93225ad64f3381a8c9a8e55e163a4e5bcf2221335ddfccdc6eb7cea8a46

        SHA512

        c478bec8a77dc012c404056150f727f34d9d88d3734cad914419eb9895d9ba0443dee38f844cc98108a9bb167a01569c3d7dd9f9d13976c05d633979b43098b3

      • memory/3936-13-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/3936-16-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/3936-22-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/3936-21-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/3936-10-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/3936-20-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/3936-15-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/3936-19-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/3936-17-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/3936-18-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/4004-2-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/4004-0-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/4004-5-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB

      • memory/4004-1-0x0000000000400000-0x000000000042B000-memory.dmp

        Filesize

        172KB