Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 22:01
Static task
static1
Behavioral task
behavioral1
Sample
f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
f8d767e98e8af957e78d511e094920f8
-
SHA1
62cd50cea9b064a95fbf31e049512bdf2b31d8e0
-
SHA256
2f6ef42f0d67f7785b9077ecf64403ef5f86dc85447d965a4516109f850fd903
-
SHA512
556890fcc21e2d5a1ebe00d4acf1258fac0b539cb1e7a304efd3d9db59a2d06c321ac4e2e3ae9f3e3432f91b991f05524918a4a10674e35972ce075349da1af5
-
SSDEEP
49152:dHA5Mgur5lyqkQbLxDRDvA5Ny73RX2poBMQRAN:i5idkQbND4AX2eMi
Malware Config
Extracted
bitrat
1.38
jairoandresotalvarorend.linkpc.net:9085
-
communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
-
install_dir
Googlechromeinite
-
install_file
Googlechromeinit.exe
-
tor_process
tor
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
resource yara_rule behavioral2/memory/2840-7-0x0000000005100000-0x0000000005112000-memory.dmp CustAttr -
resource yara_rule behavioral2/memory/1660-12-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-13-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-16-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-17-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-18-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-19-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-21-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-22-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-23-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-24-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-25-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-26-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-27-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-29-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-30-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-32-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-33-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-34-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-36-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-37-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-39-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-40-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-42-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-43-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-45-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1660-46-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Googlechromeinit = "C:\\Users\\Admin\\AppData\\Local\\Googlechromeinite\\Googlechromeinit.exe" f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2840 set thread context of 1660 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 86 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 20 IoCs
pid Process 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe Token: SeShutdownPrivilege 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 1660 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2840 wrote to memory of 5040 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 84 PID 2840 wrote to memory of 5040 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 84 PID 2840 wrote to memory of 5040 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 84 PID 2840 wrote to memory of 944 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 85 PID 2840 wrote to memory of 944 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 85 PID 2840 wrote to memory of 944 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 85 PID 2840 wrote to memory of 1660 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 86 PID 2840 wrote to memory of 1660 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 86 PID 2840 wrote to memory of 1660 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 86 PID 2840 wrote to memory of 1660 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 86 PID 2840 wrote to memory of 1660 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 86 PID 2840 wrote to memory of 1660 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 86 PID 2840 wrote to memory of 1660 2840 f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe"2⤵PID:5040
-
-
C:\Users\Admin\AppData\Local\Temp\f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe"2⤵PID:944
-
-
C:\Users\Admin\AppData\Local\Temp\f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8d767e98e8af957e78d511e094920f8_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1660
-