Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 14:40
Static task
static1
Behavioral task
behavioral1
Sample
e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe
-
Size
721KB
-
MD5
e2c334e419f98a1217912316e0c797a7
-
SHA1
d1f3bd5f3eed207fce7e447efba5cc87d02d989a
-
SHA256
1d9c7a3f4db08b60d9995027535db917e83f51c2e4f56d5fc862456a314203f6
-
SHA512
53c9b91205095bc4d3c40e7d3265a6c39b0952282df4fa71de3f6857b1bbd4a5cdfbcc74e689104d303f0cc75b3708e64e2bc5fb06581efb7a4134f7411de4f1
-
SSDEEP
12288:+D0c7zRDGWLYsAkdMa3JLi779XzZt58eKpieycV74SxV9Xwd:fK1DGixLi7Lv8eKDV7RV9Xm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4788 .exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\AD Network = "\"C:\\Users\\Admin\\AppData\\Local\\{22B7F37F-D58A-4007-54E2-A7295E1B888E}\\.exe\" ?" .exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A} e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0E67A6B8-A1D0-4f0d-B421-7FED69FCC971} e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0E67A6B8-A1D0-4f0d-B421-7FED69FCC971}\URL = "http://www.gigabase.ru/search?q={searchTerms}&uin=1000" e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0E67A6B8-A1D0-4f0d-B421-7FED69FCC971}\DisplayName = "Gigabase" e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0E67A6B8-A1D0-4f0d-B421-7FED69FCC971}" e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.ctel.ru/" e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 808 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe 808 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe 808 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe 808 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeManageVolumePrivilege 808 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe Token: SeDebugPrivilege 808 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 808 wrote to memory of 4788 808 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe 87 PID 808 wrote to memory of 4788 808 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe 87 PID 808 wrote to memory of 4788 808 e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e2c334e419f98a1217912316e0c797a7_JaffaCakes118.exe"1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\{22B7F37F-D58A-4007-54E2-A7295E1B888E}\.exe>2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD520165a79bcccf30bbef992c7820b2829
SHA100445acf5c6cc679e76d47b519132cb9485fd445
SHA2567104e9fd4c65275f9e5c9557188f11f56faf9e9e54543a4c8e42284830a3bc6a
SHA512eb968a59eb2fe7440596e8d57fb64b79b8ae2ddc79f8812200248653165d3b1285ffcd5d0381fd0980fecad9b76ccea613c515dfb1f1e15d850d6e3eacb0052f
-
Filesize
67KB
MD5ca9a0a2b5f9b7b83a5541bdedfc5a1bc
SHA1fc93722e8a764312e2f06f41717eaaba80dfb4a0
SHA2563c69b52540ea6cd00df2f5350b4e389de3014c4418d78b73e310aa40924655a8
SHA5121f901383e0e90d68c4464d34564dc034040aaa011e88ec0cb37dce34655a3824bb5613201f84b98e6de1c1440c3285f5ece1d6394396ac4a516d3325e63fe15b