Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
General
-
Target
894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe
-
Size
523KB
-
MD5
894737078b3cd6b44f6f4d6db828bee8
-
SHA1
c618cb2da208066781f6644326077863d2688cb2
-
SHA256
e0ce0775b5ba31db0f90d90d4c56c78a5bd7bacfdb77a616e22f41695862527e
-
SHA512
6e055815bb256ce85884be07da847738f2cd5374ac862414a10de6bb956919fb8d5f3027c773392cc3765c1bef34a9acb9c438cafd339e0fd853caf314f6eb07
-
SSDEEP
12288:oQJkMqtWvQB95/Zxc4WHqJjd/vfMzAhzWYJ9X6z4MOig:S0yfai3MkVJa4Bx
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 4948 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DefenderSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Security\\SecurityDefender.exe" 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4588 set thread context of 3832 4588 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 92 PID 4948 set thread context of 1348 4948 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 98 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 468 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 2288 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 4588 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe Token: 33 4588 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4588 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe Token: SeDebugPrivilege 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe Token: SeDebugPrivilege 4948 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe Token: 33 4948 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe Token: SeIncBasePriorityPrivilege 4948 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe Token: SeDebugPrivilege 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe Token: 33 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe Token: SeIncBasePriorityPrivilege 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe Token: SeDebugPrivilege 2288 Taskmgr.exe Token: SeSystemProfilePrivilege 2288 Taskmgr.exe Token: SeCreateGlobalPrivilege 2288 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe 2288 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4588 wrote to memory of 3832 4588 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 92 PID 4588 wrote to memory of 3832 4588 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 92 PID 4588 wrote to memory of 3832 4588 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 92 PID 4588 wrote to memory of 3832 4588 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 92 PID 4588 wrote to memory of 3832 4588 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 92 PID 4588 wrote to memory of 3832 4588 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 92 PID 4588 wrote to memory of 3832 4588 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 92 PID 4588 wrote to memory of 3832 4588 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 92 PID 3832 wrote to memory of 4948 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 93 PID 3832 wrote to memory of 4948 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 93 PID 3832 wrote to memory of 4948 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 93 PID 3832 wrote to memory of 2016 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 94 PID 3832 wrote to memory of 2016 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 94 PID 3832 wrote to memory of 2016 3832 894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe 94 PID 2016 wrote to memory of 468 2016 cmd.exe 96 PID 2016 wrote to memory of 468 2016 cmd.exe 96 PID 2016 wrote to memory of 468 2016 cmd.exe 96 PID 4948 wrote to memory of 1348 4948 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 98 PID 4948 wrote to memory of 1348 4948 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 98 PID 4948 wrote to memory of 1348 4948 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 98 PID 4948 wrote to memory of 1348 4948 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 98 PID 4948 wrote to memory of 1348 4948 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 98 PID 4948 wrote to memory of 1348 4948 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 98 PID 4948 wrote to memory of 1348 4948 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 98 PID 4948 wrote to memory of 1348 4948 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 98 PID 1348 wrote to memory of 2288 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 99 PID 1348 wrote to memory of 2288 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 99 PID 1348 wrote to memory of 2288 1348 894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\894737078b3cd6b44f6f4d6db828bee8_jaffacakes118\894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\894737078b3cd6b44f6f4d6db828bee8_jaffacakes118\894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\894737078b3cd6b44f6f4d6db828bee8_jaffacakes118\894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\894737078b3cd6b44f6f4d6db828bee8_jaffacakes118\894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2288
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10004⤵
- Runs ping.exe
PID:468
-
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\894737078b3cd6b44f6f4d6db828bee8_JaffaCakes118.exe.log
Filesize706B
MD50110f3d722cddd9753644c78a308ff57
SHA1c461bb3812ae8a3c77d0ec99850b3a88eda2ccc7
SHA25603c3a90b4c2615ddd7bc4b663ba3cce4969223c0a21c53624c6f792ffde91de4
SHA5128a581416a1a9e355e6cda1d4f2a93df807421ec2706c717c5d5d2acd004af2c14ee77d94c48e6643320dd2cd2e1072b9cfd8ecf37c0e8fb38df7d9f0c40cdf63
-
C:\Users\Admin\AppData\Local\Temp\894737078b3cd6b44f6f4d6db828bee8_jaffacakes118\894737078b3cd6b44f6f4d6db828bee8_jaffacakes118.exe
Filesize523KB
MD5894737078b3cd6b44f6f4d6db828bee8
SHA1c618cb2da208066781f6644326077863d2688cb2
SHA256e0ce0775b5ba31db0f90d90d4c56c78a5bd7bacfdb77a616e22f41695862527e
SHA5126e055815bb256ce85884be07da847738f2cd5374ac862414a10de6bb956919fb8d5f3027c773392cc3765c1bef34a9acb9c438cafd339e0fd853caf314f6eb07