Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 03:41
Behavioral task
behavioral1
Sample
4e46a05d653ff89feac1faa4d55945eb_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4e46a05d653ff89feac1faa4d55945eb_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
4e46a05d653ff89feac1faa4d55945eb_JaffaCakes118.exe
-
Size
33KB
-
MD5
4e46a05d653ff89feac1faa4d55945eb
-
SHA1
a570e9a39a9ff9d70a0a30e0a057ff94860fd356
-
SHA256
67d2adb1141f5b68c8f11d7dd7456d8628d2073a228902a71232e8f1b8d6871f
-
SHA512
85206155f564dc036206ea8dae01a65a7dcad6bc3177a556227bf24de9096b656102771deb639dce86a490a6669d4394ab2576d4fecbbf00910967c5cf8cce9c
-
SSDEEP
768:NyMHExfpdfohQEI/ctS09eqIXr1iEpTH0:0kgfroez/c0keqohiqH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3936-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3936-4-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 6 IoCs
pid Process 32 timeout.exe 3188 timeout.exe 4244 timeout.exe 4656 timeout.exe 4688 timeout.exe 1352 timeout.exe -
Enumerates processes with tasklist 1 TTPs 6 IoCs
pid Process 1388 tasklist.exe 3676 tasklist.exe 4392 tasklist.exe 4580 tasklist.exe 4332 tasklist.exe 1840 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1388 tasklist.exe Token: SeDebugPrivilege 3676 tasklist.exe Token: SeDebugPrivilege 4392 tasklist.exe Token: SeDebugPrivilege 4580 tasklist.exe Token: SeDebugPrivilege 4332 tasklist.exe Token: SeDebugPrivilege 1840 tasklist.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 3936 wrote to memory of 5036 3936 4e46a05d653ff89feac1faa4d55945eb_JaffaCakes118.exe 91 PID 3936 wrote to memory of 5036 3936 4e46a05d653ff89feac1faa4d55945eb_JaffaCakes118.exe 91 PID 3936 wrote to memory of 5036 3936 4e46a05d653ff89feac1faa4d55945eb_JaffaCakes118.exe 91 PID 5036 wrote to memory of 1388 5036 cmd.exe 92 PID 5036 wrote to memory of 1388 5036 cmd.exe 92 PID 5036 wrote to memory of 1388 5036 cmd.exe 92 PID 5036 wrote to memory of 3028 5036 cmd.exe 93 PID 5036 wrote to memory of 3028 5036 cmd.exe 93 PID 5036 wrote to memory of 3028 5036 cmd.exe 93 PID 5036 wrote to memory of 3676 5036 cmd.exe 95 PID 5036 wrote to memory of 3676 5036 cmd.exe 95 PID 5036 wrote to memory of 3676 5036 cmd.exe 95 PID 5036 wrote to memory of 2540 5036 cmd.exe 96 PID 5036 wrote to memory of 2540 5036 cmd.exe 96 PID 5036 wrote to memory of 2540 5036 cmd.exe 96 PID 5036 wrote to memory of 1352 5036 cmd.exe 98 PID 5036 wrote to memory of 1352 5036 cmd.exe 98 PID 5036 wrote to memory of 1352 5036 cmd.exe 98 PID 5036 wrote to memory of 32 5036 cmd.exe 107 PID 5036 wrote to memory of 32 5036 cmd.exe 107 PID 5036 wrote to memory of 32 5036 cmd.exe 107 PID 5036 wrote to memory of 4392 5036 cmd.exe 108 PID 5036 wrote to memory of 4392 5036 cmd.exe 108 PID 5036 wrote to memory of 4392 5036 cmd.exe 108 PID 5036 wrote to memory of 4428 5036 cmd.exe 109 PID 5036 wrote to memory of 4428 5036 cmd.exe 109 PID 5036 wrote to memory of 4428 5036 cmd.exe 109 PID 5036 wrote to memory of 4580 5036 cmd.exe 110 PID 5036 wrote to memory of 4580 5036 cmd.exe 110 PID 5036 wrote to memory of 4580 5036 cmd.exe 110 PID 5036 wrote to memory of 4804 5036 cmd.exe 111 PID 5036 wrote to memory of 4804 5036 cmd.exe 111 PID 5036 wrote to memory of 4804 5036 cmd.exe 111 PID 5036 wrote to memory of 3188 5036 cmd.exe 112 PID 5036 wrote to memory of 3188 5036 cmd.exe 112 PID 5036 wrote to memory of 3188 5036 cmd.exe 112 PID 5036 wrote to memory of 4244 5036 cmd.exe 113 PID 5036 wrote to memory of 4244 5036 cmd.exe 113 PID 5036 wrote to memory of 4244 5036 cmd.exe 113 PID 5036 wrote to memory of 4332 5036 cmd.exe 114 PID 5036 wrote to memory of 4332 5036 cmd.exe 114 PID 5036 wrote to memory of 4332 5036 cmd.exe 114 PID 5036 wrote to memory of 4432 5036 cmd.exe 115 PID 5036 wrote to memory of 4432 5036 cmd.exe 115 PID 5036 wrote to memory of 4432 5036 cmd.exe 115 PID 5036 wrote to memory of 1840 5036 cmd.exe 116 PID 5036 wrote to memory of 1840 5036 cmd.exe 116 PID 5036 wrote to memory of 1840 5036 cmd.exe 116 PID 5036 wrote to memory of 4824 5036 cmd.exe 117 PID 5036 wrote to memory of 4824 5036 cmd.exe 117 PID 5036 wrote to memory of 4824 5036 cmd.exe 117 PID 5036 wrote to memory of 4656 5036 cmd.exe 118 PID 5036 wrote to memory of 4656 5036 cmd.exe 118 PID 5036 wrote to memory of 4656 5036 cmd.exe 118 PID 5036 wrote to memory of 4688 5036 cmd.exe 119 PID 5036 wrote to memory of 4688 5036 cmd.exe 119 PID 5036 wrote to memory of 4688 5036 cmd.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e46a05d653ff89feac1faa4d55945eb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4e46a05d653ff89feac1faa4d55945eb_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Luna__GTA_Launcher_Rockstar_Edition.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq GTA5.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1388
-
-
C:\Windows\SysWOW64\findstr.exefindstr "GTA5.exe"3⤵PID:3028
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq launcher.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
C:\Windows\SysWOW64\findstr.exefindstr "launcher.exe"3⤵PID:2540
-
-
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
PID:1352
-
-
C:\Windows\SysWOW64\timeout.exetimeout 153⤵
- Delays execution with timeout.exe
PID:32
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq GTA5.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
-
C:\Windows\SysWOW64\findstr.exefindstr "GTA5.exe"3⤵PID:4428
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq launcher.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4580
-
-
C:\Windows\SysWOW64\findstr.exefindstr "launcher.exe"3⤵PID:4804
-
-
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
PID:3188
-
-
C:\Windows\SysWOW64\timeout.exetimeout 153⤵
- Delays execution with timeout.exe
PID:4244
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq GTA5.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4332
-
-
C:\Windows\SysWOW64\findstr.exefindstr "GTA5.exe"3⤵PID:4432
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq launcher.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
C:\Windows\SysWOW64\findstr.exefindstr "launcher.exe"3⤵PID:4824
-
-
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
PID:4656
-
-
C:\Windows\SysWOW64\timeout.exetimeout 153⤵
- Delays execution with timeout.exe
PID:4688
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4192 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵PID:1504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD523e2b3e0f516e9f59e1de5dde888c188
SHA1499e8c8b4f0a175d0a1e54b62932b197b5abe822
SHA2562be6713e465141b7aaa85a2a5b3489b0c4540b40e1af2b7b9e970e74fb179a56
SHA51234058e5a174ef402bf95198ccffa2a475cde9b8e7cf87577cdca488e53ef64db00bbe162900a25796827be30636d7e8c31dadfa388a6b997588166ac35b165be