Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe
-
Size
24KB
-
MD5
f20d9ab7c5d6b3373f05f38a7ba27564
-
SHA1
909c30410ea7720ca2b598872bc3f9d5236b9234
-
SHA256
17ee72c3297c4ee85ff6e7d4e42bae31b81e1cf671f8fa04a57b137cf74b77eb
-
SHA512
54340eef8a07e15b5faf22ae326facacd4bf472210167df0b76214b0a150c32aacb8a39f427f27864814af8547b22903b0b6b1d2bdf9b5053ca1013dc8478384
-
SSDEEP
384:E3eVES+/xwGkRKJvGkzlM61qmTTMVF9/q5E0:bGS+ZfbJXO8qYoAl
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4420 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 840 ipconfig.exe 4968 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4420 tasklist.exe Token: SeDebugPrivilege 4968 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4916 f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe 4916 f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4916 wrote to memory of 4952 4916 f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe 85 PID 4916 wrote to memory of 4952 4916 f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe 85 PID 4916 wrote to memory of 4952 4916 f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe 85 PID 4952 wrote to memory of 1428 4952 cmd.exe 87 PID 4952 wrote to memory of 1428 4952 cmd.exe 87 PID 4952 wrote to memory of 1428 4952 cmd.exe 87 PID 4952 wrote to memory of 840 4952 cmd.exe 88 PID 4952 wrote to memory of 840 4952 cmd.exe 88 PID 4952 wrote to memory of 840 4952 cmd.exe 88 PID 4952 wrote to memory of 4420 4952 cmd.exe 89 PID 4952 wrote to memory of 4420 4952 cmd.exe 89 PID 4952 wrote to memory of 4420 4952 cmd.exe 89 PID 4952 wrote to memory of 3604 4952 cmd.exe 92 PID 4952 wrote to memory of 3604 4952 cmd.exe 92 PID 4952 wrote to memory of 3604 4952 cmd.exe 92 PID 3604 wrote to memory of 4888 3604 net.exe 93 PID 3604 wrote to memory of 4888 3604 net.exe 93 PID 3604 wrote to memory of 4888 3604 net.exe 93 PID 4952 wrote to memory of 4968 4952 cmd.exe 94 PID 4952 wrote to memory of 4968 4952 cmd.exe 94 PID 4952 wrote to memory of 4968 4952 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:1428
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:840
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:4888
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:4968
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5b381d700791c8aac852d1a8517aed3d2
SHA1ad062a2739164b0bd99b2bfe2195c46483de8da4
SHA2567fa749f3e6a38da1182c26e7f6de3fa2416bb3fa817d9b51e258d0a12055166a
SHA5121dfcf3ad4deb7ee71c3da2f074d7fd07dce51cf6ee8f1c3da34daf314a670796cc72850fa87176864de109ec12f1f4fa605f7b0ba3a990908f8a2dc5fb71fadc