Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/04/2024, 00:01
Static task
static1
Behavioral task
behavioral1
Sample
e399d426f0b3ae0d1a41ae2f3f510c9b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e399d426f0b3ae0d1a41ae2f3f510c9b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e399d426f0b3ae0d1a41ae2f3f510c9b_JaffaCakes118.exe
-
Size
58KB
-
MD5
e399d426f0b3ae0d1a41ae2f3f510c9b
-
SHA1
65f9cc88ca9da07e17eb60f26c14fc68fd25547e
-
SHA256
deb12559fd7e424bae5f92a77b828b8f025e4e0410f52641ff8ac3020965f28a
-
SHA512
e673ecbd65bc21b544085f05cf651f631e1cfce46b7ed71f2f2688dfda927a24ea6c578051eb337c85a50b0b1bfbb07cee040f308c1765920a3ae6337e428141
-
SSDEEP
1536:+TBnz9z9BaKu01Buu5eamvFPNY9CafVDMzixXm:+NRBsKf5gNYQYAzi4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2444 outlook.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Windows\\sys32.exe" e399d426f0b3ae0d1a41ae2f3f510c9b_JaffaCakes118.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\sys32.exe e399d426f0b3ae0d1a41ae2f3f510c9b_JaffaCakes118.exe File created C:\Windows\outlook.exe e399d426f0b3ae0d1a41ae2f3f510c9b_JaffaCakes118.exe File opened for modification C:\Windows\outlook.exe e399d426f0b3ae0d1a41ae2f3f510c9b_JaffaCakes118.exe File opened for modification C:\Windows\sys32.exe e399d426f0b3ae0d1a41ae2f3f510c9b_JaffaCakes118.exe File opened for modification C:\Windows\outlook.cfg outlook.exe File created C:\Windows\crc32.cfg outlook.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2100 2444 WerFault.exe 85 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3316 wrote to memory of 2444 3316 e399d426f0b3ae0d1a41ae2f3f510c9b_JaffaCakes118.exe 85 PID 3316 wrote to memory of 2444 3316 e399d426f0b3ae0d1a41ae2f3f510c9b_JaffaCakes118.exe 85 PID 3316 wrote to memory of 2444 3316 e399d426f0b3ae0d1a41ae2f3f510c9b_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\e399d426f0b3ae0d1a41ae2f3f510c9b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e399d426f0b3ae0d1a41ae2f3f510c9b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\outlook.exeC:\Windows\outlook.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 298603⤵
- Program crash
PID:2100
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2444 -ip 24441⤵PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD509d4829cfdfcdd2814ecde5e22c5ce3b
SHA1afca47e68a2cb8cf3249c6adf7d803e770b8fe04
SHA2561bd9ad9d396b02eed3723e739ef02667fbc66a6adb53208d701ee7c8d09f03ab
SHA5126b58e26081b80ce74b8955ae2ce5163cba80c89e6d27ac6b98716bcc7ff0b161240c86e8b660e411f1752fc323c23516022dcc06c3c6606e7a6b58d0cf2d72bc
-
Filesize
742B
MD5c548d9a5d0fde51bcf2169feb9309fba
SHA1756d7fc358d82835985b3870d5b656702f06c1a3
SHA256b839008ae42afa86deea68007d71114a7cc73e6d7b02c9276f09a8efb472dc90
SHA5125e66456ba7f83cd83360ac1a02bc4de67dd91e6b80294da3350622ae92a67233e9d7a8b62f40b5b484b6e8008575c50a384852d1a6b4e3597699ccc095575591
-
Filesize
1KB
MD5aa3dbfdafa8edddee0363fc0bdcea206
SHA1e5960ee16ab366baaaf0ce6f647978c641850a36
SHA25684dc77fc6077370f1b8a2dc9b799117156e4a8b87dbf8d25df06d5bd93b2be1a
SHA512c13c4795d72f5dbb695d5af61a6f7c3102c2574e4ea30944b8d1c399045f49a558c602b6f5a8e502b035da49aa2420d3ecb5ab80b5afac33212a1fa58f83c6aa
-
Filesize
1KB
MD5b333ba8d9683268d501d940f77e245d5
SHA1ffb1ac0aec5ead142cfe1e4f18712c6f6fd0020f
SHA2566394d53052355dd8695a3d706e80577678e4674ef9757d14ef6b5ba631a2db3a
SHA512ad69bb8c2e70f4347090a61c8c371dc96f4f7801433a5d6c709ea41faef77bc44fad60e05db7460b7a1f73f2924c1e38385141516ef8ec3a39d4edc0619a62c7
-
Filesize
49KB
MD50e9379e357aba95f8b9883af9b67675e
SHA1280a174a414e5b8588f42b6328af2c8c8ff4394f
SHA25696b9c4ead67d03eb2c69103a983274e013e3466e80d8f95bd7cf3aea8be05b28
SHA5126cc383806882729cd889b025802ac0d5e1c55a74b3e7d7c98932644e8802fe52b5b14a886eff70ab7deaa70fb60bb9898e55b5cd83b5b99e2a2d107dce367784