Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 22:56
Static task
static1
Behavioral task
behavioral1
Sample
6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe
-
Size
161KB
-
MD5
6135da252a0f6ecd2b5cd390510c9ffa
-
SHA1
7f2492a421ee71c198dba0099ac5459aaae73cfd
-
SHA256
4e276904a581746b4600ab7eaa6da8a6d497b1b8e02088737e31445cab556506
-
SHA512
74317193831157b314d62ed038ed38ad1016b34069701095d50ea5c95938b24d7d51c9980c8e0f02d3eabd04094f36ba5d42306fd7d9210b7ca57e9a05cd9583
-
SSDEEP
3072:dqnyWt+C25wRXv1fasottOWHD44lU9guWg5Mcac:xr5wRpa9Hj7gjJ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\IESettingSync 6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2644 6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe 2644 6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2644
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5ac13abc23d0a7e60750933b08bc95698
SHA18546be5e416f54b1ebe84237744b70e6e8662ba0
SHA256df365f84b1b4643d88e1b5526331480dc5f0e46fb555097373808e70a86de49b
SHA5125eb53f8ba1297f171f9e75497f2c27b0700d047e0e8cba6e9de9f6d4da3338bc055298a59f4927f6e0f3bcb8309056b12e0ad5d56a3ea5c6a62203e45d555f30
-
Filesize
7KB
MD598c45cca9bee3a206a2aa669559bed0f
SHA1bd8f11d1f758816e065ffe46add6ce6b9932784a
SHA256fb7836167c59cb32c533c9a88f5280250f2c453ef5ded0bb87c2543992784005
SHA5124fac1716f814862339a1c660c3d23de0e3bf787205bb0aa4007bf722278c9afb152306f21690d9368ec7f77e48ad944bbcc58313fe1014d4ddb8ad32844244b0