Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2024, 04:38

General

  • Target

    5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe

  • Size

    5.5MB

  • MD5

    5584c0c10d40e931daf01714d0e77144

  • SHA1

    658a01a5269eb9a62eaf069e89911ebf1c0f5bdf

  • SHA256

    ab5cd09daccd9e45a609a6ac84447b73438cca576de35dbc969355ebe23b64db

  • SHA512

    712f640b692223dc7003f2d037e52b30388d7dbfb07e86c562dc4985abc2861bd9091aaeae7bafdb19596bde3300e7169966eaee31b0f41cab5092a185793e3d

  • SSDEEP

    98304:uXN2YoxaYNVZDFczlZC74jpJi5ew6Mi4pVr+8cXZKgmyzQ8EYazoaYO9qcOIlq:i2cY5DFOqCq5/i4pVi9IPy9ZyfPlq

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Users\Admin\AppData\Local\Temp\is-UM5NK.tmp\5584c0c10d40e931daf01714d0e77144_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-UM5NK.tmp\5584c0c10d40e931daf01714d0e77144_JaffaCakes118.tmp" /SL5="$501D6,5458712,53248,C:\Users\Admin\AppData\Local\Temp\5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1256

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-UM5NK.tmp\5584c0c10d40e931daf01714d0e77144_JaffaCakes118.tmp

    Filesize

    669KB

    MD5

    52950ac9e2b481453082f096120e355a

    SHA1

    159c09db1abcee9114b4f792ffba255c78a6e6c3

    SHA256

    25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd

    SHA512

    5b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba

  • memory/1256-28-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-26-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-10-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-40-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-14-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-16-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-18-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-20-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-38-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-22-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-24-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-36-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-30-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-32-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1256-34-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/2948-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2948-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/2948-13-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB