Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 01:15

General

  • Target

    2848d6951dc3661c1fd34fac5ba22492_JaffaCakes118.exe

  • Size

    74KB

  • MD5

    2848d6951dc3661c1fd34fac5ba22492

  • SHA1

    1a1b8593e0a35a6e2ba6960de354da8285203e79

  • SHA256

    bd2c01b4f0370887274bf893f3bf1cf14f63bbcadbb52fb39e6f9d2107471a1f

  • SHA512

    dd80c3a5adab6df8ecc39f8cb39ca12ad9b97e751d5dceb129f09ada90fe2a1c29f6869e1b68d5da3661923e8a0723d1408cfe64e954e816677432a2f002d348

  • SSDEEP

    1536:XQpQ5EP0ijnRTXJTgdLeAyNzkXuBBov6HVTCBajEdbcC:XQIURTXJTceAL4B+6HVbICC

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2848d6951dc3661c1fd34fac5ba22492_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2848d6951dc3661c1fd34fac5ba22492_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nswBE02.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    0dc0cc7a6d9db685bf05a7e5f3ea4781

    SHA1

    5d8b6268eeec9d8d904bc9d988a4b588b392213f

    SHA256

    8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

    SHA512

    814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

  • C:\Users\Admin\AppData\Local\Temp\nswBE02.tmp\ioSpecial.ini

    Filesize

    592B

    MD5

    ef9b3c1e1cd1e24ffb05b13042fbd489

    SHA1

    3b5a9c95998dedc48fd3831f2f8d541b6c2a6540

    SHA256

    2c4349b9055e9d7d99ccaa671205e513fe6a99b4478f65be3f9f88cc40a04a66

    SHA512

    c412ad16dd39a1aa3d644cf698b91945fcc0f4d5e877950b002c66e7f83f34b66d63acd963cf5b2ca8d2d86e2c3e04ba2d48c0f78bed9791e419f2bbcf0ddc67

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    74KB

    MD5

    2848d6951dc3661c1fd34fac5ba22492

    SHA1

    1a1b8593e0a35a6e2ba6960de354da8285203e79

    SHA256

    bd2c01b4f0370887274bf893f3bf1cf14f63bbcadbb52fb39e6f9d2107471a1f

    SHA512

    dd80c3a5adab6df8ecc39f8cb39ca12ad9b97e751d5dceb129f09ada90fe2a1c29f6869e1b68d5da3661923e8a0723d1408cfe64e954e816677432a2f002d348