Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 11:26
Static task
static1
Behavioral task
behavioral1
Sample
345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$_3_.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$_3_.exe
Resource
win10v2004-20240508-en
General
-
Target
345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe
-
Size
967KB
-
MD5
345afdeff01a318bae48ef80ec680227
-
SHA1
1388f456fabffe068de6e39429afee0a0b4c9c72
-
SHA256
58cb93ebbf4fb0ccfa194ba814b45eb4413d9122a911806ca799494a7746b971
-
SHA512
2a7a4fe80de99462dbad49a087536dd93fd1904fd1ea47f2da711c006ac39b37ca91014a9067e8bc5c63d8b89028ab3e640b0acbec24bdabde83b3d861e21758
-
SSDEEP
24576:ztXCT35bEN60Yc/rMegvH6RK1aeGokgwHv:zKBtV6MjvH6RIrDCv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation internal345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4648 internal345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4412 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4648 internal345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe 4648 internal345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4648 internal345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe 4648 internal345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe 4648 internal345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2380 wrote to memory of 4648 2380 345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe 82 PID 2380 wrote to memory of 4648 2380 345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe 82 PID 2380 wrote to memory of 4648 2380 345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe 82 PID 4648 wrote to memory of 3652 4648 internal345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe 89 PID 4648 wrote to memory of 3652 4648 internal345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe 89 PID 4648 wrote to memory of 3652 4648 internal345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe 89 PID 3652 wrote to memory of 4412 3652 cmd.exe 91 PID 3652 wrote to memory of 4412 3652 cmd.exe 91 PID 3652 wrote to memory of 4412 3652 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\nsq48E2.tmp\internal345afdeff01a318bae48ef80ec680227_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\nsq48E2.tmp\internal345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe C:/Users/Admin/AppData/Local/Temp/nsq48E2.tmp /baseInstaller='C:/Users/Admin/AppData/Local/Temp/345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe' /fallbackfolder='C:/Users/Admin/AppData/Local/Temp/nsq48E2.tmp/fallbackfiles/'2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\19420.bat" "C:\Users\Admin\AppData\Local\Temp\7245C4C616004E87AAD376CCD80129F7\""3⤵
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 1 -w 10004⤵
- Runs ping.exe
PID:4412
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
214B
MD5739fcc7ba42b209fe44bea47e7a8c48f
SHA1bc7a448a7c018133edcf012bc94301623eb42c5b
SHA25669017cdbbe68396f45e41d211b22d800cc1afc0eadbd3440873038585020315c
SHA5122b2b130798b0f4e534626b9fb5deaa10bb1930e6700ac0ba7cf151c1bf3239039a7032ea67ceed86a4a4dbe981064c42a8e0f88fe8361e27002dd8ceb0ea767a
-
C:\Users\Admin\AppData\Local\Temp\7245C4C616004E87AAD376CCD80129F7\7245C4C616004E87AAD376CCD80129F7_LogFile.txt
Filesize9KB
MD56784c8068b14dba53390a273b28101ee
SHA16211c93a08cde2bebff33bf7d02803ba69017d43
SHA256194bc570ed04bc5966e94ea35ea5ccb7b5c90326761242777b33158545b383a4
SHA51299b7051433dfbfb637c5c692fe7053904163944910ac079bb1906b67c61fe8ce13e792f9ac5d66078169cf1e647a231d22a914b2ac0e4c9364acbf1837597e56
-
Filesize
107KB
MD5e707e176bccfd7b7691b6da12a1d4501
SHA1df60f5a5119c00b9d4678338eb71d6f283bb5bd6
SHA256b04041e317411c12961577015433ed1f1003b69cd55a89995012c0dac4760778
SHA512bb39508a87fe6a30f0344013e051d14c723af06ebdab854e20dab2a8c56e5077f00d5d00a6ba80605e66ccc70341f0f2e3476fdc6413541da7112451b6beebc7
-
C:\Users\Admin\AppData\Local\Temp\nsq48E2.tmp\internal345afdeff01a318bae48ef80ec680227_JaffaCakes118.exe
Filesize1.8MB
MD577bfacca17ee1d89833b57f3a746d9a0
SHA1aa9490c913489c5eafd02f67f875efcb56d23036
SHA25638571b0965110d07c6fbf4813ab628d4017cf52c681c457fb3f184b644fb0b52
SHA51221ecc2fce94a58cd39127964730b01722b9dafa20d3af65b023fe83188c08211ba1324849513ffc10b6a359737f98c4d06770dc1954f8880daff938a06581e6f
-
C:\Users\Admin\AppData\Local\Temp\nsq48E2.tmp\internal345afdeff01a318bae48ef80ec680227_JaffaCakes118_icon.ico
Filesize11KB
MD5592abe695d3fb84c8a7589b0d2553a97
SHA1d70d6de6fa25ca1924bd02b84075ee94f3870133
SHA256ed59d25e5daf4e4c89c09a4c829ac4d12f1b0e258d167760a07bce6266cebda0
SHA512a8c09f8f35790a0bcf4b69ffa7f26eb60b8e14394ecef6a63c1776e538eb749251545dda48f6a7243c91d9779d24b4d774b39dbd966d32e5fa39071fff9a0978
-
C:\Users\Admin\AppData\Local\Temp\nsq48E2.tmp\internal345afdeff01a318bae48ef80ec680227_JaffaCakes118_splash.png
Filesize136KB
MD50a8589de904eec91522c276d896216c4
SHA158ba5e9158c3afa3c3112fe1e24567996794c07e
SHA256496d42e72d7c57969f584849a8f7366783afd39862f7f71b59d78b723225cd55
SHA512bea912ebc889e6444532beacbe562038b78c918dff9bfa16d7d9a15e25f52ce90e93a6736636926ef7d45e65eb8f73da92149e3188cf5a4b78a8d248b3b0d9fd