Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2024, 12:27

General

  • Target

    3fda62d225b996689370e49ace584024_JaffaCakes118.exe

  • Size

    228KB

  • MD5

    3fda62d225b996689370e49ace584024

  • SHA1

    5ac51aaa9af6c28153c2c84b20580cfe576a2345

  • SHA256

    19075bef02751617b806bed66352f791ab93cf456e4e4debd66f9d0adfadeab9

  • SHA512

    b75090ea01d31df3c10e98bcc03ecf4a4ebfce4853d0592759cee8d0b51c212225d657461e4ca14dc93154daedb7f38ffc7e1ea5aad024354b6ffff55e6af390

  • SSDEEP

    6144:zAmIhgpYy4c2+keFKEK7kmR/qszYX1932QVTH3jRVI6a:zVIhgpYR+keoAmRCsm9Zs

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3fda62d225b996689370e49ace584024_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3fda62d225b996689370e49ace584024_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1468
    • C:\Users\Admin\AppData\Local\Temp\ins8093\ins8093.exe
      "C:\Users\Admin\AppData\Local\Temp\ins8093\ins8093.exe" ins.exe /e10742466 /u52173bb8-0ed4-4c29-9d48-482f0a000013
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:180
      • C:\Users\Admin\AppData\Local\Temp\ins8093\ins.exe
        "C:\Users\Admin\AppData\Local\Temp\ins8093\ins.exe" /e10742466 /u52173bb8-0ed4-4c29-9d48-482f0a000013
        3⤵
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ins8093\ins.exe

    Filesize

    253KB

    MD5

    990774201cab9f23e9b2a4dbfd7b322d

    SHA1

    a77b83a8a3b9efcc38e8b3d1c42e681c1450470c

    SHA256

    68da632d702639815cc5875aefd103304c528df93bd8e197e7d6335787d131ae

    SHA512

    1d15af0b2a44b23319ffe35164b285868a32cd7b2e5810bf97902d5f91891eaf6f8f6e182d0ca9e6090a670f768567a3f667a95451d93e9881734f0c8b2ebde5

  • C:\Users\Admin\AppData\Local\Temp\ins8093\ins8093.exe

    Filesize

    137KB

    MD5

    658f4a04835c8522c64b73d478cb023d

    SHA1

    c1ed730661467a430e41247d5518afeb25ca7f7d

    SHA256

    d8e92455694e8d5cd8266221e5a536014b57df4169cb6793a5dabb0b42f0d781

    SHA512

    c36ad5a49416f1dc0fa67068a106d120449ec3bb6e39a05e3730ca4cc982d6a7b01bbe7993ec74f3351223529ef3eb0a0df1f27180012ac21fadf5e2d953e1eb

  • memory/180-32-0x00007FFFD22F0000-0x00007FFFD2C91000-memory.dmp

    Filesize

    9.6MB

  • memory/180-12-0x00007FFFD25A5000-0x00007FFFD25A6000-memory.dmp

    Filesize

    4KB

  • memory/180-13-0x00007FFFD22F0000-0x00007FFFD2C91000-memory.dmp

    Filesize

    9.6MB

  • memory/180-15-0x00007FFFD22F0000-0x00007FFFD2C91000-memory.dmp

    Filesize

    9.6MB

  • memory/180-36-0x00007FFFD22F0000-0x00007FFFD2C91000-memory.dmp

    Filesize

    9.6MB

  • memory/1468-31-0x0000000000B80000-0x0000000000BDE000-memory.dmp

    Filesize

    376KB

  • memory/1468-0-0x0000000000B80000-0x0000000000BDE000-memory.dmp

    Filesize

    376KB

  • memory/1468-38-0x0000000000B80000-0x0000000000BDE000-memory.dmp

    Filesize

    376KB

  • memory/4000-28-0x00000000736D0000-0x0000000073C81000-memory.dmp

    Filesize

    5.7MB

  • memory/4000-27-0x00000000736D0000-0x0000000073C81000-memory.dmp

    Filesize

    5.7MB

  • memory/4000-34-0x00000000736D0000-0x0000000073C81000-memory.dmp

    Filesize

    5.7MB

  • memory/4000-26-0x00000000736D2000-0x00000000736D3000-memory.dmp

    Filesize

    4KB