Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 23:59
Static task
static1
Behavioral task
behavioral1
Sample
e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe
-
Size
43KB
-
MD5
e398d11d48cb29ad19b6f8c397d17075
-
SHA1
fc9c24d10314584c19189d2ee2861291f6124b73
-
SHA256
436ebc3aa03e072cc805fb19853ae6c43be065b416378c7d1e85281bfaff2204
-
SHA512
3d5c61155cf120cd0a5fdb8e4c18c44513f5bf46b8f6b1619821be6f98fcb37ab1fb4d9ec24ad42f3e9e6403c412bedc5b884d8b84ddc42a93c31a1c4ac60e73
-
SSDEEP
768:sbUnHumDRFMzEDNbRjLOyDo03FpUL3QdX:sbUnHLFMzEDNl1pMgZ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4752 fxstaller.exe 2232 fxstaller.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control Center = "fxstaller.exe" e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3416 set thread context of 4980 3416 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 85 PID 4752 set thread context of 2232 4752 fxstaller.exe 95 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\fxstaller.exe e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe File opened for modification C:\Windows\fxstaller.exe e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3416 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 4752 fxstaller.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3416 wrote to memory of 4980 3416 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 85 PID 3416 wrote to memory of 4980 3416 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 85 PID 3416 wrote to memory of 4980 3416 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 85 PID 3416 wrote to memory of 4980 3416 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 85 PID 3416 wrote to memory of 4980 3416 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 85 PID 3416 wrote to memory of 4980 3416 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 85 PID 3416 wrote to memory of 4980 3416 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 85 PID 3416 wrote to memory of 4980 3416 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 85 PID 4980 wrote to memory of 4752 4980 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 94 PID 4980 wrote to memory of 4752 4980 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 94 PID 4980 wrote to memory of 4752 4980 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 94 PID 4752 wrote to memory of 2232 4752 fxstaller.exe 95 PID 4752 wrote to memory of 2232 4752 fxstaller.exe 95 PID 4752 wrote to memory of 2232 4752 fxstaller.exe 95 PID 4752 wrote to memory of 2232 4752 fxstaller.exe 95 PID 4752 wrote to memory of 2232 4752 fxstaller.exe 95 PID 4752 wrote to memory of 2232 4752 fxstaller.exe 95 PID 4752 wrote to memory of 2232 4752 fxstaller.exe 95 PID 4752 wrote to memory of 2232 4752 fxstaller.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\fxstaller.exe"C:\Windows\fxstaller.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\fxstaller.exe"C:\Windows\fxstaller.exe"4⤵
- Executes dropped EXE
PID:2232
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5e398d11d48cb29ad19b6f8c397d17075
SHA1fc9c24d10314584c19189d2ee2861291f6124b73
SHA256436ebc3aa03e072cc805fb19853ae6c43be065b416378c7d1e85281bfaff2204
SHA5123d5c61155cf120cd0a5fdb8e4c18c44513f5bf46b8f6b1619821be6f98fcb37ab1fb4d9ec24ad42f3e9e6403c412bedc5b884d8b84ddc42a93c31a1c4ac60e73