Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 00:42
Static task
static1
Behavioral task
behavioral1
Sample
017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe
-
Size
129KB
-
MD5
017c442d3b0223d6ff1d4ffb9df66554
-
SHA1
ef7fe7dca117c6a1e3842d0ccc0f2b876c78ac25
-
SHA256
c935362aadb2a3ffcd0f49a1ffb4ce7f920176653d50d348a5228963a8c7e448
-
SHA512
8ce6271e29fbaeadeebb16a44b43a72acd7e2c1258b509c35a0b1dbbc42b8292e79b20d5bfd7e53e6c61d318d01c67b59fc30cae8a0581aa919e956f9469cda5
-
SSDEEP
3072:iqujQz19o6kq4WRVLM9uk5A6kVd6fIIZ661p:xAAY6kwRZ6B5A6kVd6ftY
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\helpme.exe 017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe File created C:\Windows\SysWOW64\helpme.exe 017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Debug\winhlp.dll 017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B00FA89-7C1A-41F1-AF62-C7FF0D3B96A7} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B00FA89-7C1A-41F1-AF62-C7FF0D3B96A7}\ = "url" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B00FA89-7C1A-41F1-AF62-C7FF0D3B96A7}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B00FA89-7C1A-41F1-AF62-C7FF0D3B96A7}\InProcServer32\ = "C:\\Windows\\Debug\\winhlp.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B00FA89-7C1A-41F1-AF62-C7FF0D3B96A7}\InProcServer32\ThreadingModel = "Apartment" regedit.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2528 regedit.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2220 wrote to memory of 3972 2220 017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe 90 PID 2220 wrote to memory of 3972 2220 017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe 90 PID 2220 wrote to memory of 3972 2220 017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe 90 PID 2220 wrote to memory of 116 2220 017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe 92 PID 2220 wrote to memory of 116 2220 017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe 92 PID 2220 wrote to memory of 116 2220 017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe 92 PID 3972 wrote to memory of 2528 3972 cmd.exe 94 PID 3972 wrote to memory of 2528 3972 cmd.exe 94 PID 3972 wrote to memory of 2528 3972 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\wjaw.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\regedit.exeregedit /s C:\Users\Admin\AppData\Local\Temp\xdsfw.reg3⤵
- Modifies registry class
- Runs .reg file with regedit
PID:2528
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\017c442d3b0223d6ff1d4ffb9df66554_JaffaCakes118.exe"2⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:1580
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD59eaf332297c95d0f5525bd93f0535b80
SHA1dcae53735fb62cbfadae86b9b6678f30526d714b
SHA2564732f12a6ae955a8ec5ff67e0bf9375af3ab35c6dcc2a3bcc74b987db028565c
SHA512f4418d7a9bc456922242e6be8caa22738206bbc3a4bcb65d6a32f3e32e624f50ba0058b0cae16495b92c3379eb2ea50194f1ec343ace8188cb2f6a54a2d46f90
-
Filesize
402B
MD5bb338472ef0e2e25a20506b43e2d9d9a
SHA1b22dd7c9b1d524f771aafc8b0b8a6bdccc8bec30
SHA256963088b4fb19b383ebc4408b3778ce04b34fd628d24720e8fbe28d8bc2bc3434
SHA512eb16785a2ea6e16fd8b158284911398796f91d8f5532f367951f54e1379d016ac4e2bb3106102a98d7efd43eee8dde70e49761360f0131e747b6e7fdf42a4843