Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 22:20
Static task
static1
Behavioral task
behavioral1
Sample
484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe
-
Size
314KB
-
MD5
484cc2b7b6885bc648af88ff0c113a2e
-
SHA1
b00d0feaf7f49c712ac3afc5bf477c2536d96068
-
SHA256
7474b54de6676a288a732ed25333e2c25389c7250063ce30db6ca50388cde161
-
SHA512
2ae6d48813ffa96dd3a5f426d8654b94213fc6e629f30a2187dec65a70c5815df67957851cd4cbac7f3d7477b39a5a86923a1d07fd968b2873c0330ce28b72c0
-
SSDEEP
6144:crYbUzkuvcBYC47l2xSHyxdphxUIdRyZBBMX9v9y8DBMq:crdkuveY354dH3diBMX9v9NZ
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 3956 484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe 3956 484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe 3956 484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3956 484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe 3956 484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3956 wrote to memory of 5080 3956 484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe 85 PID 3956 wrote to memory of 5080 3956 484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe 85 PID 3956 wrote to memory of 5080 3956 484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\484cc2b7b6885bc648af88ff0c113a2e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tinF6AF.bat"2⤵PID:5080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
368B
MD53a9830a2f57ef1e602de02bd9cc8eb56
SHA15135a0295755e536b833c6c6010900ff99cdbabf
SHA2568d138bedf3228f7ef9405940526a73f49395fd2917aa22e7d5596297e222da42
SHA51287ed85acdc1509bb02e437f50e7a90695f66b2a7a996a526f0310ba277de9ce8d7343983e2ae0b5dbedcca832bb90da802d7182972f1b14be0a203cfbd14cc41
-
Filesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
Filesize
50B
MD57363a77f0323fceb63c8bacca407e503
SHA11d6ba0aebb4ea4b9e5f3e9a3ebf11558bc887ab9
SHA25635ccacf0af3271890b724f89c3bb0d605f18984788c3f9351c26fda08baa233e
SHA5120d8ec8c7e2d71327a0d8ca748a33b3f5a1199c667b7c4c0c05cbbe10ee700e013aedcbfefac9835c353564c41051ccee0a9d2cc507c2feb3de33378ce86c4fe4
-
Filesize
91KB
MD5f953369c56a2186eb0c5ce75c5be3d91
SHA1f5ceade5c31a58fda7b0bcae9fcd5033eb1f07bc
SHA256f887bf518575dfaf1b8939ddbfb1444a4893ff1a725480bd3d11f712246b8325
SHA51217b50e481c1a538368e24242d0abd0f46ac232104714934d9534bf22c2c096853ddf7515c0d73da2a5c45fdf78b68a724444461947bf707596adef912c1e3be9
-
Filesize
2KB
MD5b897598924e4bb627be8f5619a163bc6
SHA1563381fac59e6a669b01966f6f5efedba3de120a
SHA256850049f83140b0621dfca19c2b7f1461b119191536505926bf834a72567c0cb4
SHA512765faa88538e9054ebe246a1b1a7fc4cf34dd8d202e794737d8be10181e445352c1088d8d01cc895e3afdef83e2bc9d65ea3de1318c6862c2840aee052b400f3
-
Filesize
15KB
MD5e717f6ce3a7429bfa6d7f3cf66737a4b
SHA101f4042589b4ed88c351ffeac256be7a9d884818
SHA2567be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633
SHA51265a9a27430811aa01b55cf365f8b7b9f03e70d32ec60e0706242bc568242bcd493999dc1b02d92bf0d01c0095c8c38d30f282a998cafb80e60ad07e0d875ce80
-
Filesize
4KB
MD5bc0cc58d78524df57706c77168e357d8
SHA16eb2a4aacc0e88a2c4ccd355e73a3e89b53cf490
SHA256d6e746f4600d12aadb97bb2839da80dab9dc90647fc04c0501aa0ae7e8a3b4d1
SHA5120dc44381ca976bcf518731dd322dc44cca2ae496cd5ab1dfcff386f3b29ec0ce32ceee235bccf2efa6070f3208e89b8c1c21739109189a4b29ee645f02e8bc4c
-
Filesize
173KB
MD58d90a58f7e3d5aa8d76b2b3f1547ec34
SHA1c720c9591e60f405114a2c4875e0c51edd954a6d
SHA25634b4d095cad0a695ace1103011aa02d8a4113f76982f4e054fe239b8ee835af7
SHA512840b21b6352a6e2b493a32cf734e682a6806639a0b3c20ed9db4c000b0c314b2709ce676f546ef9f6b30bfb40383eb7e2bd95396c27395e20f5049cbecce644a