Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 17:31
Static task
static1
Behavioral task
behavioral1
Sample
edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe
-
Size
194KB
-
MD5
edf8c397adac678ad8b11df86c1abbf9
-
SHA1
d9fc64ed98a69ac96d9044858d23dc633bb6acc8
-
SHA256
8e6c5bd07989f54a55be814760bf148a1c49c4e66161c0d00563413832d027b8
-
SHA512
e1bff306daf491eb923e0fbe2c79e4a031c07be082d37379dfc2a3bb9bd10772a2e6280feb0f195c32764fe84c7a7d3746cae6f898ea9e393ecf03b93fc253e1
-
SSDEEP
3072:hqUEwVwd0zjld+I/0cmbM+fulMHxznGteKJGJoJuuO73EmjA09+sL:j7VASjlQI/0bfKMTOJ2oMuhPs
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
pid Process 4492 edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe 4492 edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lphcl9kj0erv8 = "C:\\Windows\\system32\\lphcl9kj0erv8.exe" edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\phcl9kj0erv8.bmp edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe File created C:\Windows\SysWOW64\blphcl9kj0erv8.scr edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\system32\\phcl9kj0erv8.bmp" edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000486acc2d320b21400000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000486acc2d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900486acc2d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d486acc2d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000486acc2d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe -
Modifies Control Panel 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\system32\\phcl9kj0erv8.bmp" edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\blphcl9kj0erv8.scr" edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\ScreenSaveActive = "1" edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Colors\Background = "0 0 255" edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\WallpaperStyle = "0" edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\TileWallpaper = "0" edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\OriginalWallpaper = "C:\\Windows\\system32\\phcl9kj0erv8.bmp" edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4492 edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe 4492 edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4492 edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeBackupPrivilege 3268 vssvc.exe Token: SeRestorePrivilege 3268 vssvc.exe Token: SeAuditPrivilege 3268 vssvc.exe Token: SeBackupPrivilege 3964 srtasks.exe Token: SeRestorePrivilege 3964 srtasks.exe Token: SeSecurityPrivilege 3964 srtasks.exe Token: SeTakeOwnershipPrivilege 3964 srtasks.exe Token: SeBackupPrivilege 3964 srtasks.exe Token: SeRestorePrivilege 3964 srtasks.exe Token: SeSecurityPrivilege 3964 srtasks.exe Token: SeTakeOwnershipPrivilege 3964 srtasks.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4492 wrote to memory of 404 4492 edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe 85 PID 4492 wrote to memory of 404 4492 edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe 85 PID 4492 wrote to memory of 404 4492 edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe 85 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Checks processor information in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\.tt4611.tmp.vbs"2⤵PID:404
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:31⤵PID:3132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1002B
MD59df700c8f6fd43fac0a89aef04214bbd
SHA16ec8bc6d4041ccf19757757c0da6592469f71c57
SHA2569ab6f2c3cc3965cd05f81d859bdfac3b25a5e70178f61ea677d31987c4e142fd
SHA5128bbcd322f3998c0f7d81884737ca313c1353ac7e3899f168fc8d44eafbe064193353b8b16f92113288ff2102c47623b542861440c414b8acf36d75c4ad645d4d
-
Filesize
116KB
MD5b10a43b9044b488dc8c7d33b250cfebb
SHA150100ea46001cc84ec2047c2be142e8a44b94664
SHA2565f81ba145a4cf8afff3eeefc8f22b4c69dadcb3cce5ce63abcc54de3d04e3eb3
SHA51241f2539e0dd8405992f95ec3eeab166dd7d976f7e13b809d6706242f1aa5ccb6b2c92338caf155d43cff228f57da262a394804c602c1fd75652b0a0535c7b61c