Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 02:07
Behavioral task
behavioral1
Sample
c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe
-
Size
7.9MB
-
MD5
c7e6e40a655c8fa822ee5d6ef50b2c0a
-
SHA1
da24022739f524d7b32879f27fc75a53e11ba225
-
SHA256
aacc73072a2319d7f0909b9ea1809abb168772db1790636d28447506d621ca0a
-
SHA512
65ae439d0c402cc76ca39bd03f496855f7964c87f8d46a9404398d1e11a2f65d8aebb7dccb8c59bda6609c00156c98a1dd34f831431399438a726d253212f7c8
-
SSDEEP
98304:VbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbiF:o
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/2092-0-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023202-7.dat upx behavioral2/memory/2092-87-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 46 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2092 c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2092 c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2092 c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe 2092 c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c7e6e40a655c8fa822ee5d6ef50b2c0a_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.9MB
MD5e542905d26f30a8f0198c24d654796fb
SHA1d313e5fa8652c7620ec279ae2959a49289b5c422
SHA2565e0f1c6ed0a98293c5f80daebadb02474e15d56f8281c9f517c05162380b07c7
SHA51269b0308e391d8b6f38e4a406dcb6d207f448e7a2e3993fe62b7f5579340d5bc1faeefa74aec32f5389fb8b3c255ca9f38d985c32f2940993bf5a6541671a6c24