Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 06:31
Static task
static1
Behavioral task
behavioral1
Sample
f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.exe
-
Size
417KB
-
MD5
f32a10b6563c44f044d0f23d973c438b
-
SHA1
694c07a21391b923f145de6cddc5365583361bc7
-
SHA256
23663eb4b97744b7b9402a7aed8276a637bd7e6a39beb0abf29121b7d2e8b205
-
SHA512
b282ee343d0e898f23d4a38a550d100a807950d0d1b66eb4dfda2ce175313a6b7bb1187fabfe846b615dfa14f923990839f06dd7efe165505de44eff1aa12679
-
SSDEEP
6144:2/QiQP7CL6lhU7dXYwQfEyZFpD4G0dkxXyVlcG40eAw38o85XOC8T/FUyKGpM9Ck:OQiG7Cn7dXYwEZZFp8njlcGpX98iR4o
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2068 f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.tmp -
Loads dropped DLL 2 IoCs
pid Process 2068 f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.tmp 2068 f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.tmp -
Checks for any installed AV software in registry 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Software\K7 Computing\K7TotalSecurity f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.tmp Key opened \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Software\Sophos\Sophos Anti-Virus f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.tmp -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 10 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4040 powershell.exe 4040 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4040 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3440 wrote to memory of 2068 3440 f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.exe 86 PID 3440 wrote to memory of 2068 3440 f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.exe 86 PID 3440 wrote to memory of 2068 3440 f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.exe 86 PID 2068 wrote to memory of 1824 2068 f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.tmp 90 PID 2068 wrote to memory of 1824 2068 f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.tmp 90 PID 2068 wrote to memory of 1824 2068 f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.tmp 90 PID 1824 wrote to memory of 4040 1824 cmd.exe 92 PID 1824 wrote to memory of 4040 1824 cmd.exe 92 PID 1824 wrote to memory of 4040 1824 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\is-D4AS7.tmp\f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-D4AS7.tmp\f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.tmp" /SL5="$401CA,139007,56832,C:\Users\Admin\AppData\Local\Temp\f32a10b6563c44f044d0f23d973c438b_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-8T737.tmp\ex.bat""3⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1B
MD568b329da9893e34099c7d8ad5cb9c940
SHA1adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA25601ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
SHA512be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
-
Filesize
786B
MD5c053a6c8edc15d58a6f27cbf9741ed55
SHA1f5f4f9e828cb6ec73c8d037875a00c1ff2b69439
SHA2567f84c9e6354c877092564afa5a09c978a61fc60aebe268c43923af8d421eb8d6
SHA51209366abe48e54d3f4ca0d3fa29c99570db6de111e89bfc6edcb5d341b1126f2a00f31222d374295b915ec321854ba8e821bb169344f5cd8871a59f41fbe9596b
-
Filesize
201KB
MD5fda896f0acbb98fa2fd8763f7e0a7b7d
SHA187520c200aa1ee03fa627073053b9887147b2975
SHA2562182268006a950cb31f425e4ce8aa31c9b4d5f7f84dd09e8a854710ddde31b0e
SHA5122dfc45451a3128ff87910c1cfca91556e69f4cf367b9072e32e0af1676eba1a8c473e061e78971e910ca6d6889ad9b1aca2a4c56186e7003d200fe5f57f39550
-
Filesize
694KB
MD586462bc76b244bac73ee6ffe47354be2
SHA1c66462dc233887f86f9e05ee36086de4edfd99b6
SHA256e3da91f01ffb504352b5e8237a5465d0f492a750a7c9a6cef22b3a5d08230fc9
SHA512c0cbe3a39c2fd18e257500faacafd9fc8913221278e492b355acf64e6d97ff622a46a325a5c18cee5843a1660fda64dbc3172fac642de77ed12321085d67cb65