Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/10/2024, 12:15

General

  • Target

    5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe

  • Size

    1.8MB

  • MD5

    5205816a750cb86b88614ea22faa75b3

  • SHA1

    3baadad2368136bcff6fcb8af87b6cc00aa9b6cb

  • SHA256

    a30c050d5c41a945070a45ed9b547fe0d9def41a86a09cb6ca600382faf64099

  • SHA512

    1d499bbb3b1eba26953f046e46ef23f6d407f958f0add500efb5d934e264042328434731a61d9f8cd00e33b5551f1190c02c52278af3d6e03a0a491c9fbd3ec4

  • SSDEEP

    49152:+JoY1Zt0lF/80bvurP1mDufYZ0MynTW3B:artkW0bv+9fGynQ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2852
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c \DelUS.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\DelUS.bat

    Filesize

    228B

    MD5

    074b268456dbdfd4cf77824701bf00fe

    SHA1

    9fd6d14a90d2695bcda865ef4541c41ccd8dd4dd

    SHA256

    7123f9d0c5b3a03e66afd5b1ee1d65a7befe7aa4b4a028bc36a7df9604d59096

    SHA512

    4a9dff90a22b429d102e3f73fad236d717e1ce8ac71c78143f0be830119a10a61465a9056c359b00ac679de486f58e146e86bfeebe2de96a1723e1723891e9c0

  • C:\Users\Admin\AppData\Local\Temp\nss8C05.tmp\ISCHECK2.dll

    Filesize

    92KB

    MD5

    9b758e25eeb7298a61776391310a11f7

    SHA1

    5f05ac39f0027197e391e0ef43a3ef9ec160426a

    SHA256

    7e58ea6ce4c690eb69b16cb1260a9d7127fcb6cdd43cfa1f360571607d9b9a9e

    SHA512

    23f1236a0181b3735e4f311781c236b78883f8f76ee3b3ba0cd2ab6836a7977d8ea4ff16546d00d5419ed4190e584d4ceeba2389ed9c4325a84d468ee883895c

  • C:\Users\Admin\AppData\Local\Temp\nss8C05.tmp\SelfDelete.dll

    Filesize

    24KB

    MD5

    7bf1bd7661385621c7908e36958f582e

    SHA1

    43242d7731c097e95fb96753c8262609ff929410

    SHA256

    c0ad2c13d48c9fe62f898da822a5f08be3bf6c4e2c1c7ffdf7634f2ca4a8859e

    SHA512

    8317af5cc3ac802eb095f3fa8cc71daa1265ca58fead031c07872f3d4bb07663a7002ae734fad392a7617f0923fe0caf1f54ed55afdf8516a6a08e202d86fa7f