Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 04:51
Static task
static1
Behavioral task
behavioral1
Sample
02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe
-
Size
148KB
-
MD5
02f1adf78225d68fda17b11920a68c0a
-
SHA1
2917deaf26fef106460fee14f7e1678ae3856fde
-
SHA256
203861e33e8933c4f8c590715a0c6d909becd1a1a1ee38106648c8edfd154e69
-
SHA512
66d0ab5592f8c62a4dec6d54b231ca43182c2a0e2f90ebae45ae0729a54956d000e77ff3f01c2e90d87e4dae25e576bae0656d34d74377a94c3e82b8f688b809
-
SSDEEP
3072:6rdcqkEDx0mYh5uw7Iw8Vh4yxn/26BAx00lUrRdU:QcqxCZhc0I7NnOf09RdU
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 5108 yalzalilqn.exe -
Loads dropped DLL 1 IoCs
pid Process 5108 yalzalilqn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 3248 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3728 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5108 yalzalilqn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3248 taskkill.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5108 yalzalilqn.exe 5108 yalzalilqn.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 5108 yalzalilqn.exe 5108 yalzalilqn.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4792 wrote to memory of 1612 4792 02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe 81 PID 4792 wrote to memory of 1612 4792 02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe 81 PID 4792 wrote to memory of 1612 4792 02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe 81 PID 1612 wrote to memory of 3248 1612 cmd.exe 83 PID 1612 wrote to memory of 3248 1612 cmd.exe 83 PID 1612 wrote to memory of 3248 1612 cmd.exe 83 PID 1612 wrote to memory of 3728 1612 cmd.exe 85 PID 1612 wrote to memory of 3728 1612 cmd.exe 85 PID 1612 wrote to memory of 3728 1612 cmd.exe 85 PID 1612 wrote to memory of 5108 1612 cmd.exe 86 PID 1612 wrote to memory of 5108 1612 cmd.exe 86 PID 1612 wrote to memory of 5108 1612 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 4792 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\YALZAL~1.EXE -f2⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 47923⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3248
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:3728
-
-
C:\Users\Admin\AppData\Local\yalzalilqn.exeC:\Users\Admin\AppData\Local\YALZAL~1.EXE -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5108
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD502f1adf78225d68fda17b11920a68c0a
SHA12917deaf26fef106460fee14f7e1678ae3856fde
SHA256203861e33e8933c4f8c590715a0c6d909becd1a1a1ee38106648c8edfd154e69
SHA51266d0ab5592f8c62a4dec6d54b231ca43182c2a0e2f90ebae45ae0729a54956d000e77ff3f01c2e90d87e4dae25e576bae0656d34d74377a94c3e82b8f688b809