Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 08:40
Behavioral task
behavioral1
Sample
f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe
-
Size
84KB
-
MD5
f9edce2c3e8e1fde251aa74ef501bae3
-
SHA1
e379bf3fb40b59028359b27deeb985b05211d76b
-
SHA256
15cbc1faf58ae12ad49c620d23a8e159d4940fb31e09b5c751e9599eff4e451a
-
SHA512
48866ee2c95b7c9870ebe06bf695a8b2e9fa4b5fd308c9d647c3234017ad804cc488d13c183e1aeedc87f6bfd260ba850bac89bcfb1cac0cb261884187315ef1
-
SSDEEP
1536:s9Z3KcR4mjD9r8226+d9Z3KcR4mjD9r8226+usKsG2PLnI:sr3KcWmjRrzSdr3KcWmjRrzSxJjnI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 416 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2728-0-0x00000000006C0000-0x00000000006D7000-memory.dmp upx behavioral2/files/0x00070000000233ec-8.dat upx behavioral2/memory/416-7-0x0000000000730000-0x0000000000747000-memory.dmp upx behavioral2/memory/2728-9-0x00000000006C0000-0x00000000006D7000-memory.dmp upx behavioral2/files/0x000a00000002332a-12.dat upx behavioral2/files/0x00070000000233eb-29.dat upx behavioral2/memory/416-32-0x0000000000730000-0x0000000000747000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2728 f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe Token: SeDebugPrivilege 416 CTS.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2728 wrote to memory of 416 2728 f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe 86 PID 2728 wrote to memory of 416 2728 f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe 86 PID 2728 wrote to memory of 416 2728 f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9edce2c3e8e1fde251aa74ef501bae3_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:416
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
392KB
MD589f84c142d56760d81daa59a73b8388d
SHA19a563888a3421069830093419ce110b1f1a42065
SHA25675662e7003b7ffa6be15924c7c767fcf4915cd1fe5eea0a9b62a37bfbd944f34
SHA5129f089cff4e1229e7b8e4f404ed8e336cad4ef694e8d8935b53a153f1c0fb9d542b8926fbbfe4751a047271233a0c5a200849371ad985dbc863c296d7e606c521
-
Filesize
84KB
MD5decb364031e9b515933f0dea747b3681
SHA11a0cb6a47c7c8b367505b268c9758d00d15f52b3
SHA25644bbec24e69ecff5e7c906af289449d4b0e2b5f425e02a87b1e5af63643c00da
SHA512fb0749993bbf3d4385f7a07ab9bff82ae9375a9391cd41f27fbe3da9a417e33c2150c2810cab5b5ca80b600be3a79b645e796cf4e422db95f025aa955b959820
-
Filesize
71KB
MD557dc894376d6ffbf9af1929bd6688b6c
SHA1cf5f1891e39142f13d3f007e2957a0d302efafff
SHA25625001e3946468d3aa0f86f1ae322fb8354fc1c96052227346c41fb12d63fa129
SHA512922c081df01cdcaef8cf91a484bdfe1c412a5e716aada86b3f3f61e020173cc9bd8318c072eff7f59140687fdaf3a722d62fc4c56891f906797a909da311dab1