Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 20:12
Behavioral task
behavioral1
Sample
eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe
-
Size
52KB
-
MD5
eebc14dc671e8987bfbf8a7324d39c32
-
SHA1
31aca267dd6fe314db15eeb0e64f6ce8eb3b7ec1
-
SHA256
0b045e2dbcc371b3cda3ed893de3bb407aa42e063b86d71e3ef8f3a68ec804d1
-
SHA512
ab71ae56a7b9219ef8a9ea03dd20d40a8ec369e385b2384dbcee3cd7518339ebcfbd8361c6583928957687e1fcb2bba76545ed4de00106ae1b03864f77913264
-
SSDEEP
1536:N5VzcfA/6LrVpL74gfh16nHNq5DwhQBlr4suu0Fc/hd:/V2A/gVh74gpgt00h+0Fc/hd
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 924 EINslazR05Bjmfr.exe 4696 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4760-0-0x00000000005C0000-0x00000000005D8000-memory.dmp upx behavioral2/files/0x000c000000023b73-6.dat upx behavioral2/memory/4760-9-0x00000000005C0000-0x00000000005D8000-memory.dmp upx behavioral2/memory/4696-10-0x0000000000DC0000-0x0000000000DD8000-memory.dmp upx behavioral2/files/0x000b0000000162b0-14.dat upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4760 eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe Token: SeDebugPrivilege 4696 CTS.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4760 wrote to memory of 924 4760 eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe 83 PID 4760 wrote to memory of 924 4760 eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe 83 PID 4760 wrote to memory of 4696 4760 eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe 84 PID 4760 wrote to memory of 4696 4760 eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe 84 PID 4760 wrote to memory of 4696 4760 eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eebc14dc671e8987bfbf8a7324d39c32_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\EINslazR05Bjmfr.exeC:\Users\Admin\AppData\Local\Temp\EINslazR05Bjmfr.exe2⤵
- Executes dropped EXE
PID:924
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
350KB
MD5eece5309a24e944b239a85c2e5724bee
SHA1e64ca55d6401abe5e36aa08e81b7c782e45c9e74
SHA2567b0cb9f6eabc643f8ab4b0f6cfc60b8598683424a2e0780b9d6a933feea8f487
SHA51236967d9300818fcc04b8c74e335bf782ee56d75cb6d7b1d11fef313a7d18157f14390322edb7ec921229fa465f4d12c14179ce4bd9a63b1298d13a961b559a5d
-
Filesize
25KB
MD5abbd49c180a2f8703f6306d6fa731fdc
SHA1d63f4bfe7f74936b2fbace803e3da6103fbf6586
SHA2565f411c0bd9ed9a42b0f07ed568c7d0cf358a83063b225a1f8f7da3296dde90f1
SHA512290dd984acc451b778f3db8c510bae7aec1d9547c3ad0a1829df731c136e4ecc9a37dc6a786cf8f1ecc4d14339aed1288af25055f450f6f953138c8d4d5c36e9
-
Filesize
27KB
MD5a6749b968461644db5cc0ecceffb224a
SHA12795aa37b8586986a34437081351cdd791749a90
SHA256720023737d7ff700818f55612ba069a609a5ddea646bb3509b615ee3523a4ca2
SHA5122a276816290746ed914af9cf6427aef31ce9395b8e9937090e329a8f74fb84c62d15b196e13346caa086842b3f5f549b9eb20cbf422d18c9c1b63e6342ea90b4