Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 23:21
Static task
static1
Behavioral task
behavioral1
Sample
37141d21044b40a776c51cdc13b86899_JaffaCakes118.js
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
37141d21044b40a776c51cdc13b86899_JaffaCakes118.js
Resource
win10v2004-20240508-en
General
-
Target
37141d21044b40a776c51cdc13b86899_JaffaCakes118.js
-
Size
73KB
-
MD5
37141d21044b40a776c51cdc13b86899
-
SHA1
8f987d9c56e12e6641754115cb0d65d6c34e69c6
-
SHA256
e2fb246070404a9e7f9a42bc88f3429ee9f7bc4470c4ac939db46be21e165287
-
SHA512
2cb85962acafa8d0ce385917b425f5ede4ab503d1224073aae783e57b5eab3589bd423b47e1c6d7f689c5cce0bf791de84d897fb95ecf64ffd59f30758b4fdcc
-
SSDEEP
1536:d8cQPMz4GlHNvQYviFSD17fdN85bxYYhVfGAGnNUHORWR:6cQPM8GdNv6ERYLN7SNEKWR
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 4084 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37141d21044b40a776c51cdc13b86899_JaffaCakes118.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37141d21044b40a776c51cdc13b86899_JaffaCakes118.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\37141d21044b40a776c51cdc13b86899_JaffaCakes118 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\37141d21044b40a776c51cdc13b86899_JaffaCakes118.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\37141d21044b40a776c51cdc13b86899_JaffaCakes118 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\37141d21044b40a776c51cdc13b86899_JaffaCakes118.js\"" wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37141d21044b40a776c51cdc13b86899_JaffaCakes118.js
Filesize73KB
MD537141d21044b40a776c51cdc13b86899
SHA18f987d9c56e12e6641754115cb0d65d6c34e69c6
SHA256e2fb246070404a9e7f9a42bc88f3429ee9f7bc4470c4ac939db46be21e165287
SHA5122cb85962acafa8d0ce385917b425f5ede4ab503d1224073aae783e57b5eab3589bd423b47e1c6d7f689c5cce0bf791de84d897fb95ecf64ffd59f30758b4fdcc