Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 07:34
Static task
static1
Behavioral task
behavioral1
Sample
ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe
-
Size
52KB
-
MD5
ea904e91e1f7cfa59118378c10ea02d5
-
SHA1
e6e331b02feb4fd195576ac7b7ed1c302055c40b
-
SHA256
3e405cf51962c5cab5fbfe7825be054082e1ccdc36277d2c87bcff5edc5619d2
-
SHA512
6da468b53ff3601c494bc32b8e075f12ed49a9fba4f33524a0397200eb88f701c815bde6534be237c371e203d55bc2e39cf3b6882058f5471223f732afa9d440
-
SSDEEP
768:tzFfdBozItqlxy+zv9HtixQaPQPS71cZdb109YSBkO6gKYOmGBH:tzr0Itq7yMv9Htix/PjWvO9YSSTBY8BH
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1048 ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe 4980 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSServer = "rundll32.exe C:\\Windows\\system32\\vtUlLCus.dll,#1" rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vtUlLCus.dll ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xxyxXNfF.dll ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe File created C:\Windows\SysWOW64\xxyxXNfF.dll ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe File created C:\Windows\SysWOW64\vtUlLCus.dll ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BFEC4FFD-9C0E-4B2E-A6C7-03A9437447D9}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BFEC4FFD-9C0E-4B2E-A6C7-03A9437447D9}\InprocServer32\ = "C:\\Windows\\SysWow64\\vtUlLCus.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BFEC4FFD-9C0E-4B2E-A6C7-03A9437447D9}\InprocServer32\ThreadingModel = "Both" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BFEC4FFD-9C0E-4B2E-A6C7-03A9437447D9} rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1048 ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe 1048 ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe 4980 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1048 ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1048 ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1048 wrote to memory of 636 1048 ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe 5 PID 1048 wrote to memory of 4980 1048 ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe 98 PID 1048 wrote to memory of 4980 1048 ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe 98 PID 1048 wrote to memory of 4980 1048 ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe 98 PID 1048 wrote to memory of 2084 1048 ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe 99 PID 1048 wrote to memory of 2084 1048 ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe 99 PID 1048 wrote to memory of 2084 1048 ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe 99
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\system32\vtUlLCus.dll,a2⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4980
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\ea904e91e1f7cfa59118378c10ea02d5_JaffaCakes118.exe"2⤵PID:2084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43B
MD59a7ef09167a6f4433681b94351509043
SHA1259b1375ed8e84943ca1d42646bb416325c89e12
SHA256d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7
SHA51296b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df
-
Filesize
37KB
MD56f3f3e47806e643ebe0ef26f298d6438
SHA13e47e11fec25b78189de73b9abf06cdae1fe2eb0
SHA25675af970866ba003cafe11f98f90ac8df548061e911c9b4058dbd2587972afd38
SHA51227af7de073dfc2d989e61b50e35cdc2a2228348de2b1da1beb6c0cccb32b2516d80e8549b4c1b6d125511105bc99a1f77e06ea3114035417104dc2a1fc341f19