Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 21:56
Static task
static1
Behavioral task
behavioral1
Sample
e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe
-
Size
199KB
-
MD5
e3600cdb71f3db0c3fef8918b68a33f5
-
SHA1
3142e1e9dcb858967d694c2efac26aba7053846c
-
SHA256
45f0d85fd880bf24e0a28f88b6fa6628bbf8e51eb5965ca57a0a1f5d0be8fae5
-
SHA512
95f5904055155a59b791bad7df73e75575e774fed30810d3b95894a0f26800faea851efe721f6c560d23767cf8a81f41d13f31b9418a2e87aa217fc9a80cc431
-
SSDEEP
3072:VmbReHY1lcee3DFRFNVfQMTzHPDizD9h5NSAsF5hYGk1Zssdqibd3Y/BpeOM:yRWY1KJrvfQMTSn5mF5jQss0JkOM
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe" e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118 = "C:\\Windows\\msng.exe" e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\msng.exe e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe File opened for modification C:\Windows\msng.exe e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4168 1764 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1764 e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe 1764 e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe 1764 e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe 1764 e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1764 e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e3600cdb71f3db0c3fef8918b68a33f5_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1764 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 2162⤵
- Program crash
PID:4168
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1764 -ip 17641⤵PID:4428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5fda44910deb1a460be4ac5d56d61d837
SHA1f6d0c643351580307b2eaa6a7560e76965496bc7
SHA256933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9
SHA51257dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1