Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 01:00

General

  • Target

    281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe

  • Size

    87KB

  • MD5

    281d30ff9aedb2d4ad9fed57faa786c2

  • SHA1

    ac6a3c95cbfb3e32e700a88e20a99032b4cedc73

  • SHA256

    0e1f1086d8e50e261d3c5182171f5d56cea4d376add5434412c1dd9fd2d17df9

  • SHA512

    75552872fa111d20b1db50db157ad50b39497d772fa4158b1244595e0a1095c3d60c881894a1bd13c8b353d82d60736445de6904daa73f9941078acb10383272

  • SSDEEP

    1536:yOF3OLr5Oi3hhOSmXjQXNhXm558NSY1WMaUXXunq:DO/vwXwNhokSTjE

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4464
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 948
      2⤵
      • Program crash
      PID:3684
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4464 -ip 4464
    1⤵
      PID:3524

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\7z.dll

      Filesize

      1.8MB

      MD5

      05a522bfcb1f62f3ceb4c0a14e9eb525

      SHA1

      5a6b7091da48fe1b0de60325e07f4a4aded63919

      SHA256

      91734047589c326e70e0de090f9a1c6e0f695d034e87ef0df18cb32e181f18f6

      SHA512

      0e830cbf8320faa44dc0e555bfeae7e464767e1d55b8a6b87819c32e399a6722ddaa02be782d67efe2eb6efa7c27db4645850bd72b457067bb586337573778b0

    • C:\Program Files\Microsoft Office\AppXManifest.xml

      Filesize

      5B

      MD5

      b5b682b742431a52ea8b17c72ad9c572

      SHA1

      326320f469235708c59f678c9a7357dca552d306

      SHA256

      30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

      SHA512

      4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

    • C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK

      Filesize

      119B

      MD5

      da7c482f5358bd9da5bbfe76e3447a8e

      SHA1

      dc0e0a748e790dc04133c65b52cd69b1676bd9c2

      SHA256

      4a4c9f290dadb6052556670faf60e07f0cc3c6f5a7b478d2da2234be8ea5508b

      SHA512

      e9bb5f64535ebed8a4f38bc4144b3dc4dedcf6a3010a87a0cfa2306fbdc5ce8d3e9fd00ad9ae019548b3085edca33283c507325a6c484f66b484778a035878bc

    • C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK

      Filesize

      118B

      MD5

      805ae32d41bd54cee2613872031b2c20

      SHA1

      5c2201ef44d4c345c2ad40bf67c3cb5f17509bad

      SHA256

      641723ac1f2a767466006fb811f8140370ef9f2904398ee77f160c0e7bda7ba0

      SHA512

      a40328c1800ff312c79e873b9cdc1cc8fd4b61629fcf379257401b167c45fa53c3a019eb1bc6fb55ae8e9e74b9ad8e226163d75918f564e787f57696670688b0