Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 09:18
Behavioral task
behavioral1
Sample
a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe
-
Size
92KB
-
MD5
a13a17b39004d2d7cfddfdf593dde04d
-
SHA1
bf09ba32f8b775fd22afc11627f3a9f8bbecf390
-
SHA256
49ca89dc49848bf43c7689672f40d232d0910961cb5dd88d2157d1639f655a21
-
SHA512
463fe3f9fae565f83bbdd12ffa5971a5b9c67dcc8fd56ad34a05b7e3612da66b6b900431492bfcf28144b6dc277f2c999fe273edadcee262d0661d05cecac098
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtr2:9bfVk29te2jqxCEtg30Bq
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 1 IoCs
resource yara_rule behavioral2/files/0x000b000000023b7c-2.dat family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4868 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1160 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4652 a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4652 wrote to memory of 4868 4652 a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe 85 PID 4652 wrote to memory of 4868 4652 a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe 85 PID 4652 wrote to memory of 4868 4652 a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe 85 PID 4652 wrote to memory of 4060 4652 a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe 100 PID 4652 wrote to memory of 4060 4652 a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe 100 PID 4652 wrote to memory of 4060 4652 a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe 100 PID 4060 wrote to memory of 1160 4060 cmd.exe 102 PID 4060 wrote to memory of 1160 4060 cmd.exe 102 PID 4060 wrote to memory of 1160 4060 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
PID:4868
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\a13a17b39004d2d7cfddfdf593dde04d_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1160
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD50f75c9ff5a198013c5ee3e949bb75487
SHA1d158ce3096c1f29a2780cc93e2913a9e50bff5a2
SHA256a4b72b20158df18a3547fa0d1544bd1ad7314ad1ae9d594ba544be6e077b068b
SHA5126ba0273b5b8a2449b77a01a79ceaaf0cade6d6372d6fc325bd414885a621296ad5e9f977667680c2955426717d345aa211be007a335da499c4047a8a68a68954