Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2024, 01:51

General

  • Target

    d01c1791496b85dc15c40e8ee442a49e_JaffaCakes118.exe

  • Size

    1.8MB

  • MD5

    d01c1791496b85dc15c40e8ee442a49e

  • SHA1

    f68e7ea602d9618f8796f5b1c031f0db4de3376e

  • SHA256

    e0412214ce67433f44e4e5e62ea81b0672ad535e4ed91f8ee4c1a3d82a48d79e

  • SHA512

    2194d29fa256878e673290074ac6a3df98446abd306d98fef9020edc03e9f533032a02891ef612e0f2009a06cc3864dbeb42be4564f3ca3344479aee731ce207

  • SSDEEP

    49152:zqEM6l7Oh7rfoSP/n4Tr3cEpmXK8mHRMMMvMMM3:Gt6l7IYSnnCyK8mxMMMvMMM3

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d01c1791496b85dc15c40e8ee442a49e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d01c1791496b85dc15c40e8ee442a49e_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Users\Admin\AppData\Local\Temp\2008_server.exe
      "C:\Users\Admin\AppData\Local\Temp\2008_server.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1524
    • C:\Users\Admin\AppData\Local\Temp\ÅÜÅÜ¿¨¶¡³µ.exe
      "C:\Users\Admin\AppData\Local\Temp\ÅÜÅÜ¿¨¶¡³µ.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4884

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2008_server.exe

    Filesize

    1.8MB

    MD5

    e6a041eee77e6e2edc02cd22263ad1ce

    SHA1

    0b3ecdb517afdd7a8f013f098930585e732384b6

    SHA256

    7b508803a3fd2d74002e5edb280ed22f70c56904f56bce9071a53919c76576bf

    SHA512

    62505f28766562623a092e66a91f2fb6e83baefc70e8dd271c7fbe42242035b0e2b2717589c250a8bce05c7493f83daa779319d3d8eceed2c07b8d965b7c64e5

  • C:\Users\Admin\AppData\Local\Temp\ÅÜÅÜ¿¨¶¡³µ.exe

    Filesize

    44KB

    MD5

    ab9b19a47ef00f0d552fee4937d2ab10

    SHA1

    b381044014e0c0561d0e08e9e256edb8022850cf

    SHA256

    1802d56348a9c7e54e8f2d7ea980b6a145fe6a3f5e95663517e01b5a9f8f8d67

    SHA512

    807ac051f7b3f97474dbf464c12cc3a4f3ac32a31c7b8c5019664012c62fff5fd0f973d34b4030dc871d6a4da62cf1130463781d97cddb5cf2eaee291e13023c

  • memory/1524-34-0x00000000035F0000-0x00000000035F1000-memory.dmp

    Filesize

    4KB

  • memory/1524-27-0x0000000002570000-0x0000000002571000-memory.dmp

    Filesize

    4KB

  • memory/1524-46-0x0000000003600000-0x0000000003601000-memory.dmp

    Filesize

    4KB

  • memory/1524-41-0x00000000035F0000-0x00000000035F1000-memory.dmp

    Filesize

    4KB

  • memory/1524-40-0x00000000035F0000-0x00000000035F1000-memory.dmp

    Filesize

    4KB

  • memory/1524-39-0x00000000035F0000-0x00000000035F1000-memory.dmp

    Filesize

    4KB

  • memory/1524-42-0x00000000035F0000-0x00000000036DC000-memory.dmp

    Filesize

    944KB

  • memory/1524-43-0x00000000035F0000-0x00000000036DC000-memory.dmp

    Filesize

    944KB

  • memory/1524-38-0x00000000035F0000-0x00000000035F1000-memory.dmp

    Filesize

    4KB

  • memory/1524-37-0x00000000035F0000-0x00000000035F1000-memory.dmp

    Filesize

    4KB

  • memory/1524-36-0x00000000035F0000-0x00000000035F1000-memory.dmp

    Filesize

    4KB

  • memory/1524-35-0x00000000035F0000-0x00000000035F1000-memory.dmp

    Filesize

    4KB

  • memory/1524-16-0x0000000000400000-0x000000000076D000-memory.dmp

    Filesize

    3.4MB

  • memory/1524-33-0x00000000035F0000-0x00000000035F1000-memory.dmp

    Filesize

    4KB

  • memory/1524-20-0x0000000000B40000-0x0000000000B94000-memory.dmp

    Filesize

    336KB

  • memory/1524-30-0x0000000002520000-0x0000000002521000-memory.dmp

    Filesize

    4KB

  • memory/1524-32-0x00000000035F0000-0x00000000035F1000-memory.dmp

    Filesize

    4KB

  • memory/1524-29-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/1524-28-0x0000000002560000-0x0000000002561000-memory.dmp

    Filesize

    4KB

  • memory/1524-31-0x0000000003600000-0x0000000003601000-memory.dmp

    Filesize

    4KB

  • memory/1524-26-0x0000000000C50000-0x0000000000C51000-memory.dmp

    Filesize

    4KB

  • memory/1524-25-0x0000000002510000-0x0000000002511000-memory.dmp

    Filesize

    4KB

  • memory/1524-24-0x0000000002580000-0x0000000002581000-memory.dmp

    Filesize

    4KB

  • memory/1524-23-0x0000000002530000-0x0000000002531000-memory.dmp

    Filesize

    4KB

  • memory/1524-22-0x0000000002550000-0x0000000002551000-memory.dmp

    Filesize

    4KB

  • memory/1524-44-0x0000000000400000-0x000000000076D000-memory.dmp

    Filesize

    3.4MB

  • memory/1524-45-0x0000000000B40000-0x0000000000B94000-memory.dmp

    Filesize

    336KB

  • memory/1524-47-0x00000000035F0000-0x00000000035F1000-memory.dmp

    Filesize

    4KB

  • memory/2440-21-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB