Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
2536d9c0c646bf6060f7a2d1cfe18e0e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2536d9c0c646bf6060f7a2d1cfe18e0e_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
2536d9c0c646bf6060f7a2d1cfe18e0e_JaffaCakes118.exe
-
Size
4.2MB
-
MD5
2536d9c0c646bf6060f7a2d1cfe18e0e
-
SHA1
a732f010fc3b715da6375fb68d7598d86eb2248a
-
SHA256
78fac31cf70f114baec8ec3578022194bb569de81f506c66d01b32fa1c4562fc
-
SHA512
6e99966e8f7074b1015f469a6feff29576becddb58a2e8fbe17a520f46391f93a2b0618056c1dc92518bab9304795d7868bd980895a11116de19aef24111a9a3
-
SSDEEP
98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4uluq:ovsJR0TW6yiIKRhzqOsq
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 2536d9c0c646bf6060f7a2d1cfe18e0e_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 4728 41OLJ.exe -
Executes dropped EXE 1 IoCs
pid Process 4728 41OLJ.exe -
Loads dropped DLL 2 IoCs
pid Process 4384 2536d9c0c646bf6060f7a2d1cfe18e0e_JaffaCakes118.exe 4728 41OLJ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4728 41OLJ.exe 4728 41OLJ.exe 4728 41OLJ.exe 4728 41OLJ.exe 4728 41OLJ.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4384 2536d9c0c646bf6060f7a2d1cfe18e0e_JaffaCakes118.exe Token: 0 4384 2536d9c0c646bf6060f7a2d1cfe18e0e_JaffaCakes118.exe Token: SeDebugPrivilege 4728 41OLJ.exe Token: 0 4728 41OLJ.exe Token: SeShutdownPrivilege 4728 41OLJ.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4384 wrote to memory of 4728 4384 2536d9c0c646bf6060f7a2d1cfe18e0e_JaffaCakes118.exe 95 PID 4384 wrote to memory of 4728 4384 2536d9c0c646bf6060f7a2d1cfe18e0e_JaffaCakes118.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2536d9c0c646bf6060f7a2d1cfe18e0e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2536d9c0c646bf6060f7a2d1cfe18e0e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\41OLJ.exe"C:\Users\Admin\AppData\Local\Temp\41OLJ.exe" -Continue|"C:\Users\Admin\AppData\Local\Temp\2536d9c0c646bf6060f7a2d1cfe18e0e_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:2980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD546574723deea4f7eb1ed1a08b351b608
SHA111327832da1d81abb56d2e9536d21989638fa404
SHA256fe1b0d9d782bd8eddbffa0d2ba09ddf5203021528e517ca0fef76b7e79e7c38f
SHA5125764888d20a703efaa23064c66e1bf0ee08533ca7eee5b9950dbd1b9efc9d84d6065984a0bd48d9583b407fc308887cf23e1d4f4c07c373d5af355424f970ccf
-
Filesize
13KB
MD55a8e8dedf1d910c79defff5638978d07
SHA1bfab518af8a53f02c4f98fc321aa0984a208686c
SHA256d5bf8619a6f47e74aceb629da039f25493b0b8fb2f892bda2b32bd68c0cf8893
SHA5127acfc4d0bde75a518f394319c8cd6743d36eb7ebcdcd26eeae2fb59ead70bb8b4d2fb29be93c89b529775f8a407a9bcd6e4d2a2955c03b15f2880ff9aa61a519
-
Filesize
1.3MB
MD5a70486cf41bf065ff8e76e8619745361
SHA1e06e75380b17fec737fbdfeaa4a09b83e54d4838
SHA2561563fc1966e779f0fcb71753f15e73ec770e169a0ad6e3c5af736764d9bd5858
SHA51202f1c909fcbf7c0f5604ccb4e807640d80a2236c3cac6975e2e849bda318419e7188bb6a48184940eb381e2af375c83d7539e58951edf5e49ec11dd0cff66cc0