Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 00:48
Static task
static1
Behavioral task
behavioral1
Sample
828ce5cc2d5525f796b2f2158ec9c64d_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
828ce5cc2d5525f796b2f2158ec9c64d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/installer.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/installer.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
General
-
Target
828ce5cc2d5525f796b2f2158ec9c64d_JaffaCakes118.exe
-
Size
281KB
-
MD5
828ce5cc2d5525f796b2f2158ec9c64d
-
SHA1
669104ea4ccffbda165e108c03e85d930659c9da
-
SHA256
2274693f918e6c52964cd19e8919c84886a7f94f62e14e5f51612b50380b38bd
-
SHA512
0444246a198fb34cf58649298dc74b7fd97c86adb9abf85ff76847718d59160ac44df32d362816cbf52ddbaf3fed925dd4a7730cfdcbfef2aa43a5ccdc5aa419
-
SSDEEP
6144:osaocyLCfLlqahejSXJeTathHQ3F3HutNbH+XWVi:otobEBZejuJegYuLkWV
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 524 installer.exe 5060 c44c0242-e47d-11e2-b66b-00259033c1da.exe -
Loads dropped DLL 1 IoCs
pid Process 4188 828ce5cc2d5525f796b2f2158ec9c64d_JaffaCakes118.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini installer.exe File opened for modification C:\Windows\assembly\Desktop.ini installer.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly installer.exe File created C:\Windows\assembly\Desktop.ini installer.exe File opened for modification C:\Windows\assembly\Desktop.ini installer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5060 c44c0242-e47d-11e2-b66b-00259033c1da.exe 5060 c44c0242-e47d-11e2-b66b-00259033c1da.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5060 c44c0242-e47d-11e2-b66b-00259033c1da.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5060 c44c0242-e47d-11e2-b66b-00259033c1da.exe 5060 c44c0242-e47d-11e2-b66b-00259033c1da.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4188 wrote to memory of 524 4188 828ce5cc2d5525f796b2f2158ec9c64d_JaffaCakes118.exe 90 PID 4188 wrote to memory of 524 4188 828ce5cc2d5525f796b2f2158ec9c64d_JaffaCakes118.exe 90 PID 524 wrote to memory of 5060 524 installer.exe 92 PID 524 wrote to memory of 5060 524 installer.exe 92 PID 524 wrote to memory of 5060 524 installer.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\828ce5cc2d5525f796b2f2158ec9c64d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\828ce5cc2d5525f796b2f2158ec9c64d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\nsjF5EB.tmp\installer.exeC:\Users\Admin\AppData\Local\Temp\nsjF5EB.tmp\installer.exe c44c0242-e47d-11e2-b66b-00259033c1da.exe /t10223b31951904401967dba0441c07 /dT132240201S10223b31951904401967dba0441c07 /e9504441 /uc44c0242-e47d-11e2-b66b-00259033c1da2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Users\Admin\AppData\Local\Temp\nsjF5EB.tmp\c44c0242-e47d-11e2-b66b-00259033c1da.exe/t10223b31951904401967dba0441c07 /dT132240201S10223b31951904401967dba0441c07 /e9504441 /uc44c0242-e47d-11e2-b66b-00259033c1da3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5060
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4320,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:81⤵PID:3616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
249KB
MD5e5fdaf113b510ceaf5672d7af36eaa75
SHA1ee4c3b6d2343650926944869a07e31a9a2a4ffc5
SHA256d4f2a25d2831f368313160bf2e2983264426ba9e4027447440b5a3ee8bb8b526
SHA512f55acf149353251d44d768381a9256f509c62e24479775a24924c584a29fd7cdc2f705b84318a0280ca9731c6c3b4be993045e2e925cd42ef7a9e64e21e584a8
-
Filesize
207KB
MD5de8e9cb3a534359f5809b9c5980ce365
SHA134def3bd6d46a97daa546671513733b9a94c1e8a
SHA256653db07daeedb23437e723f00ab4f7320e5bb6e6689e38e54896ee44d84cfc71
SHA512dffe030837a4babfb06419ffd893f54b9856e0f1aafb320e923a7a4aea894154207b0f2998fd0ecaaf0105c6ff1bed95d93a8ae2f531e1c8c3aca248a35b1fe2
-
Filesize
8KB
MD59f4abe9c1c095cdb505df5db52644d44
SHA194295f495f5535e0143107d3ca34141c943ec0b5
SHA256e41bd375070919e1e194a7c1ca722a30d648a7fa7a4b5c33fb05660813c18bdf
SHA512d1b6ab6d3e51f69e6ec79aa23629afc9ddedd8a7a668ea61b06bec115c95e2a35dca3ff9b9eb649e4bfece9a2fcd0832fed45f2308dca874f6e819708ed48169