Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 14:40
Static task
static1
Behavioral task
behavioral1
Sample
e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe
-
Size
721KB
-
MD5
e2c334e419f98a1217912316e0c797a7
-
SHA1
d1f3bd5f3eed207fce7e447efba5cc87d02d989a
-
SHA256
1d9c7a3f4db08b60d9995027535db917e83f51c2e4f56d5fc862456a314203f6
-
SHA512
53c9b91205095bc4d3c40e7d3265a6c39b0952282df4fa71de3f6857b1bbd4a5cdfbcc74e689104d303f0cc75b3708e64e2bc5fb06581efb7a4134f7411de4f1
-
SSDEEP
12288:+D0c7zRDGWLYsAkdMa3JLi779XzZt58eKpieycV74SxV9Xwd:fK1DGixLi7Lv8eKDV7RV9Xm
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472F-A0FF-E1416B8B2E3A} e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0E67A6B8-A1D0-4f0d-B421-7FED69FCC971} e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0E67A6B8-A1D0-4f0d-B421-7FED69FCC971}\URL = "http://www.gigabase.ru/search?q={searchTerms}&uin=1000" e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0E67A6B8-A1D0-4f0d-B421-7FED69FCC971}\DisplayName = "Gigabase" e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0E67A6B8-A1D0-4f0d-B421-7FED69FCC971}" e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.ctel.ru/" e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 360 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe 360 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 360 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeManageVolumePrivilege 360 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe Token: SeDebugPrivilege 360 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe"1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:360