Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2025, 15:53

General

  • Target

    JaffaCakes118_8a2bdb5e601deb704b795bc5eebf45da.exe

  • Size

    1.2MB

  • MD5

    8a2bdb5e601deb704b795bc5eebf45da

  • SHA1

    0c75f944e504dd81065c3c0ada2c025211dd5aa0

  • SHA256

    e7f547a1c4b5a322747bcbfcef945029971c0228c1bbf0cf43daf995c7da8b51

  • SHA512

    a3d30dc192ba36097914af922beb90f87519e528c2e655cab20d715e50bd958ea81121e65d4efa110f2876444a5955a8adb0e313faff74b22e9594fc4f38066a

  • SSDEEP

    24576:onzBtBeOxAQmXWRFJSjfUEBgddrL4/S5po1U3DBl2rs+rrv1xKAsRKsu:o9tB/rmmUsZVL4q3Bl2rs+fKo

Malware Config

Signatures

  • Detected google phishing page 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 20 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a2bdb5e601deb704b795bc5eebf45da.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a2bdb5e601deb704b795bc5eebf45da.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4828
    • C:\Users\Admin\AppData\Local\Temp\temp.exe
      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4580
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4344
  • C:\Windows\system.exe
    C:\Windows\system.exe
    1⤵
    • Detected google phishing page
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:5068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\temp.exe

    Filesize

    799KB

    MD5

    2cb734d6e80d55630dbefbdb58a9cfe2

    SHA1

    6f66e6ba349448a107720312f8a21043389034d3

    SHA256

    959ed1fcdf9476c97a155f5f2cc349b9fc2aa19e7e9d5c6dc2974d8a895cc030

    SHA512

    8a5dacb4c1c042e029c7ad2d8e05fced89c17bcc0d0a6952417272927ddd9ecfe4147b11798dce0b8bfc52aa5d55d7bee598fa510b262cb13896dba88271d1b1

  • C:\Windows\uninstal.bat

    Filesize

    134B

    MD5

    d844dfb0f997e4d32cdb6dafa4d7717a

    SHA1

    eaa7b33e52129f946e1aca0ce3cf45a7ce36b5ec

    SHA256

    0f38f96239893411209b61471bb7c2412a8637ce0e5cbf9cc3c23e14ee44759a

    SHA512

    fdeeeda586bf1d748ab962bd579ab3ef69a59ab9306bd3b29663dd496bba31e0a20b62e6076c08bfef44ad821e9dd69e88a29a56d427cbba532947cf91947be5

  • memory/4580-45-0x0000000000400000-0x00000000004D206F-memory.dmp

    Filesize

    840KB

  • memory/4828-12-0x00000000023D0000-0x00000000023D1000-memory.dmp

    Filesize

    4KB

  • memory/4828-10-0x0000000000A50000-0x0000000000A51000-memory.dmp

    Filesize

    4KB

  • memory/4828-25-0x00000000024A0000-0x00000000024A1000-memory.dmp

    Filesize

    4KB

  • memory/4828-24-0x0000000002430000-0x0000000002431000-memory.dmp

    Filesize

    4KB

  • memory/4828-23-0x0000000002450000-0x0000000002451000-memory.dmp

    Filesize

    4KB

  • memory/4828-22-0x0000000002470000-0x0000000002471000-memory.dmp

    Filesize

    4KB

  • memory/4828-21-0x0000000002490000-0x0000000002491000-memory.dmp

    Filesize

    4KB

  • memory/4828-20-0x00000000023A0000-0x00000000023A1000-memory.dmp

    Filesize

    4KB

  • memory/4828-19-0x0000000002410000-0x0000000002411000-memory.dmp

    Filesize

    4KB

  • memory/4828-18-0x00000000023E0000-0x00000000023E1000-memory.dmp

    Filesize

    4KB

  • memory/4828-17-0x00000000023F0000-0x00000000023F1000-memory.dmp

    Filesize

    4KB

  • memory/4828-16-0x0000000000A70000-0x0000000000A71000-memory.dmp

    Filesize

    4KB

  • memory/4828-15-0x0000000000A80000-0x0000000000A81000-memory.dmp

    Filesize

    4KB

  • memory/4828-14-0x0000000002400000-0x0000000002401000-memory.dmp

    Filesize

    4KB

  • memory/4828-13-0x00000000023B0000-0x00000000023B1000-memory.dmp

    Filesize

    4KB

  • memory/4828-0-0x0000000010000000-0x00000000100C1000-memory.dmp

    Filesize

    772KB

  • memory/4828-26-0x0000000003360000-0x0000000003364000-memory.dmp

    Filesize

    16KB

  • memory/4828-11-0x0000000003370000-0x0000000003372000-memory.dmp

    Filesize

    8KB

  • memory/4828-9-0x0000000003380000-0x0000000003381000-memory.dmp

    Filesize

    4KB

  • memory/4828-8-0x0000000000A20000-0x0000000000A21000-memory.dmp

    Filesize

    4KB

  • memory/4828-7-0x0000000000A30000-0x0000000000A31000-memory.dmp

    Filesize

    4KB

  • memory/4828-6-0x00000000009B0000-0x00000000009B1000-memory.dmp

    Filesize

    4KB

  • memory/4828-5-0x00000000009C0000-0x00000000009C1000-memory.dmp

    Filesize

    4KB

  • memory/4828-4-0x0000000000A40000-0x0000000000A41000-memory.dmp

    Filesize

    4KB

  • memory/4828-3-0x00000000009F0000-0x00000000009F1000-memory.dmp

    Filesize

    4KB

  • memory/4828-2-0x0000000000A10000-0x0000000000A11000-memory.dmp

    Filesize

    4KB

  • memory/4828-27-0x0000000000590000-0x0000000000591000-memory.dmp

    Filesize

    4KB

  • memory/4828-37-0x0000000010000000-0x00000000100C1000-memory.dmp

    Filesize

    772KB

  • memory/4828-40-0x0000000002240000-0x0000000002294000-memory.dmp

    Filesize

    336KB

  • memory/4828-28-0x00000000009A0000-0x00000000009A1000-memory.dmp

    Filesize

    4KB

  • memory/4828-1-0x0000000002240000-0x0000000002294000-memory.dmp

    Filesize

    336KB

  • memory/5068-64-0x0000000000400000-0x00000000004D206F-memory.dmp

    Filesize

    840KB

  • memory/5068-68-0x0000000000400000-0x00000000004D206F-memory.dmp

    Filesize

    840KB

  • memory/5068-72-0x0000000000400000-0x00000000004D206F-memory.dmp

    Filesize

    840KB

  • memory/5068-76-0x0000000000400000-0x00000000004D206F-memory.dmp

    Filesize

    840KB