Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 23:01
Behavioral task
behavioral1
Sample
f6c2c71c62029e3582df0215eb6f7038_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f6c2c71c62029e3582df0215eb6f7038_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f6c2c71c62029e3582df0215eb6f7038_JaffaCakes118.exe
-
Size
209KB
-
MD5
f6c2c71c62029e3582df0215eb6f7038
-
SHA1
7cd487c156d690de90bec954cdac5ae3d5cc551f
-
SHA256
d5a827d1ff9a96f4ed2b2f0f4bd11545f8f13796d76e7562b550e8d8a660b304
-
SHA512
2538a15da281d642f4c959361307fa44f802a646992f8167477fafebd31873fe9bb219fbd5f4cde18f136382a59d6613f43104b206f16c0c80e2420ff93cec89
-
SSDEEP
6144:+N2cx8XUGoVsGOiV3ki8VTU0uHsBR/NhW:ILfJ7OiVJ8VTUxmh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4824 msnscr.exe -
resource yara_rule behavioral2/memory/1480-0-0x0000000000400000-0x00000000004D0000-memory.dmp upx behavioral2/files/0x0009000000023285-3.dat upx behavioral2/memory/1480-5-0x0000000000400000-0x00000000004D0000-memory.dmp upx behavioral2/memory/4824-6-0x0000000000400000-0x00000000004D0000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msnscr.exe = "C:\\Windows\\system32\\msnscr.exe" f6c2c71c62029e3582df0215eb6f7038_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\msnscr.exe msnscr.exe File created C:\Windows\SysWOW64\msnscr.exe f6c2c71c62029e3582df0215eb6f7038_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msnscr.exe f6c2c71c62029e3582df0215eb6f7038_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1480 f6c2c71c62029e3582df0215eb6f7038_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1480 f6c2c71c62029e3582df0215eb6f7038_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4824 msnscr.exe Token: SeIncBasePriorityPrivilege 4824 msnscr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1480 wrote to memory of 4824 1480 f6c2c71c62029e3582df0215eb6f7038_JaffaCakes118.exe 91 PID 1480 wrote to memory of 4824 1480 f6c2c71c62029e3582df0215eb6f7038_JaffaCakes118.exe 91 PID 1480 wrote to memory of 4824 1480 f6c2c71c62029e3582df0215eb6f7038_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6c2c71c62029e3582df0215eb6f7038_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6c2c71c62029e3582df0215eb6f7038_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\msnscr.exeC:\Windows\system32\msnscr.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:4380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD5f6c2c71c62029e3582df0215eb6f7038
SHA17cd487c156d690de90bec954cdac5ae3d5cc551f
SHA256d5a827d1ff9a96f4ed2b2f0f4bd11545f8f13796d76e7562b550e8d8a660b304
SHA5122538a15da281d642f4c959361307fa44f802a646992f8167477fafebd31873fe9bb219fbd5f4cde18f136382a59d6613f43104b206f16c0c80e2420ff93cec89