Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 04:38
Static task
static1
Behavioral task
behavioral1
Sample
5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe
-
Size
5.5MB
-
MD5
5584c0c10d40e931daf01714d0e77144
-
SHA1
658a01a5269eb9a62eaf069e89911ebf1c0f5bdf
-
SHA256
ab5cd09daccd9e45a609a6ac84447b73438cca576de35dbc969355ebe23b64db
-
SHA512
712f640b692223dc7003f2d037e52b30388d7dbfb07e86c562dc4985abc2861bd9091aaeae7bafdb19596bde3300e7169966eaee31b0f41cab5092a185793e3d
-
SSDEEP
98304:uXN2YoxaYNVZDFczlZC74jpJi5ew6Mi4pVr+8cXZKgmyzQ8EYazoaYO9qcOIlq:i2cY5DFOqCq5/i4pVi9IPy9ZyfPlq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1256 5584c0c10d40e931daf01714d0e77144_JaffaCakes118.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5584c0c10d40e931daf01714d0e77144_JaffaCakes118.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2948 wrote to memory of 1256 2948 5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe 84 PID 2948 wrote to memory of 1256 2948 5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe 84 PID 2948 wrote to memory of 1256 2948 5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\is-UM5NK.tmp\5584c0c10d40e931daf01714d0e77144_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-UM5NK.tmp\5584c0c10d40e931daf01714d0e77144_JaffaCakes118.tmp" /SL5="$501D6,5458712,53248,C:\Users\Admin\AppData\Local\Temp\5584c0c10d40e931daf01714d0e77144_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1256
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD552950ac9e2b481453082f096120e355a
SHA1159c09db1abcee9114b4f792ffba255c78a6e6c3
SHA25625fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd
SHA5125b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba