Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
e356bc4de872e244470ac69afed47ad6_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e356bc4de872e244470ac69afed47ad6_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e356bc4de872e244470ac69afed47ad6_JaffaCakes118.exe
-
Size
252KB
-
MD5
e356bc4de872e244470ac69afed47ad6
-
SHA1
e189ecbaf8a57c7dc8c96b25cc54841f2d871a2c
-
SHA256
104f5602ad56976bcb9eda6e979ae60242e98e4edbbd17bf2c01a2a55f55b208
-
SHA512
a7e7e72178615c53346fd11394ca96a860deaa2a64ea2a468b988c4e453aa69e135ca736a79bb851c9eb480983252f1e3020c690e6e9b7f14bbaea363c0e54d8
-
SSDEEP
6144:x+A1yrimEU/EztV++Jbtd4lfn8hFXbTom85FMnH:xNgrimr/EztV++JZd4lfnSTo7F
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" siupin.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation e356bc4de872e244470ac69afed47ad6_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2960 siupin.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /m" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /Y" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /N" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /D" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /c" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /w" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /l" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /y" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /P" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /t" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /f" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /F" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /v" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /S" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /p" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /W" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /I" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /G" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /b" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /L" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /X" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /V" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /r" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /U" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /x" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /z" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /B" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /s" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /q" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /K" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /Z" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /M" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /j" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /n" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /R" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /Q" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /u" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /O" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /i" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /h" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /J" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /a" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /d" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /o" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /H" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /A" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /k" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /C" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /T" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /E" siupin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siupin = "C:\\Users\\Admin\\siupin.exe /e" siupin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe 2960 siupin.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4972 e356bc4de872e244470ac69afed47ad6_JaffaCakes118.exe 2960 siupin.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4972 wrote to memory of 2960 4972 e356bc4de872e244470ac69afed47ad6_JaffaCakes118.exe 98 PID 4972 wrote to memory of 2960 4972 e356bc4de872e244470ac69afed47ad6_JaffaCakes118.exe 98 PID 4972 wrote to memory of 2960 4972 e356bc4de872e244470ac69afed47ad6_JaffaCakes118.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\e356bc4de872e244470ac69afed47ad6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e356bc4de872e244470ac69afed47ad6_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\siupin.exe"C:\Users\Admin\siupin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3348 --field-trial-handle=3488,i,1267426273081718772,6254127258555406296,262144 --variations-seed-version /prefetch:81⤵PID:3444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD576a1c9aa15931569f9a6d4b28dcfbb41
SHA11953cb05c3a59b7521cc186d56493c93ede9aef9
SHA25607cbe5b3634a0673386dc0f40de026cdb88e96087ba2c831cef0ab90cc50551d
SHA5126ad940722031c5a061b41fa7ea8be828c2bc5fa97078fb7235635190eba5adfc26b2dadf4eb81117a7e387d3f505548adbbcdfb8a803d5d0902c9e4af1e9beee