Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/10/2024, 10:56
General
-
Target
3f74f529002363fa9a3a9c5c1103c3c7_JaffaCakes118.exe
-
Size
196KB
-
MD5
3f74f529002363fa9a3a9c5c1103c3c7
-
SHA1
028296c4585fa8a789f538a27ba45db560a9bc1b
-
SHA256
8bb0235f49c3f56f31c740eaae138420dbe467d778aa95bae1543d340959f20d
-
SHA512
00314190f02aa6b7216b49971a7d9b5849d51c6e8291795f5fb9768257e4874db954d895750c245cbec85aa42a09cac6337827a8539cf1202cb1a202d18c04d7
-
SSDEEP
3072:HQIerxAAwNqN/Yijo5VgdXM54h+d/NrMoDj6bU/5bVO/fWIq450lTjz3tJGPbzwL:hkWmgik4d+40hN1DjCids/e5mAzv
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f74f529002363fa9a3a9c5c1103c3c7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3f74f529002363fa9a3a9c5c1103c3c7_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\dplaysvr.exe"C:\Users\Admin\AppData\Local\dplaysvr.exe" C:\Users\Admin\AppData\Local\Temp\3f74f529002363fa9a3a9c5c1103c3c7_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5844b13c1794ecd7b4627494ce5674d13
SHA13abc5164e3152dd105f0ac8781fa36abc63dc41e
SHA256efc666da503cac3c03e5aa6b967d5e5db715c245ca842e86af4534b25905e35a
SHA5120962fa46f2de771e25a4e4c0455b78d6aca4b4e704798fc34ddcbf218b31d632255174caece9eae5f0ffacb4c0f58535c9b78d2790632cf5ef889ca69b6c544b
-
Filesize
45KB
MD5fb6b95d98d2b514695a16daf194b65b4
SHA1d3a4a1c509bfd388e8b793c461c19e7d58849980
SHA25652ddc3f01f24fcaee93e6140d208dae5e9e14fd3bc500d95b73c15927a85a4d4
SHA512840783ea178b0d0dea28319c0610cb5b4d567c830b954690a1406a4b4a08cd9d880bf2a1b758af9090c5d923af5d1f15735a9e317400064ab2397a0c41ec583f
-
Filesize
884B
MD5dd1a34efdfbf126ca8abec378480436f
SHA19acce3e10d6ae1a3720c55322861bb3f77a9f253
SHA256014aa9166f5a7e33ef3bfb6a45b51a9f67caf205d951e5ca35dec3c05f48d895
SHA512e77dbc5b4e107a5a7c6505ca2b07e7739d98c136abbe28af909931839ab387b57e24116b0dbf42aeafabf0726442087915748c552cbd55d5cdfdf8b011a42b08
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
208KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
208KB
-
Filesize
196KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
32KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB