Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 13:49
Static task
static1
Behavioral task
behavioral1
Sample
08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
-
Size
31KB
-
MD5
08e2acedfafd16f9265a4a7ae879d403
-
SHA1
df9c4c8355d4f55de7c07789b8f64190fe8f5b95
-
SHA256
7bedb2b96fdd9e645eaa1eefefc30f116102b887ca6c707e8675ad8618e955e1
-
SHA512
0155bde4aaabaf3c5126c82178e015b0bc1a13e2c7737fa2422f1d09f10ec1b7f1a4fd523967b5c47589beff9b48970df14cece50e19af774e31479a056720b2
-
SSDEEP
768:bRCtZG+ZCoOC9nR3M2NvaQITXXEdV9LQQ5Z:dKYEPNvjITX0P
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\Parameters\ServiceDll = "C:\\Windows\\system32\\lld.cvsvres" reg.exe -
Loads dropped DLL 2 IoCs
pid Process 5116 rundll32.exe 5116 rundll32.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msws.dll 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe File created C:\Windows\SysWOW64\Driver.inf 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe File created C:\Windows\SysWOW64\lld.cvsvres 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\lld.cvsvres 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe File created C:\Windows\SysWOW64\msws.dll 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4100 sc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1948 wrote to memory of 4208 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 86 PID 1948 wrote to memory of 4208 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 86 PID 1948 wrote to memory of 4208 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 86 PID 1948 wrote to memory of 384 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 87 PID 1948 wrote to memory of 384 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 87 PID 1948 wrote to memory of 384 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 87 PID 1948 wrote to memory of 4100 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 88 PID 1948 wrote to memory of 4100 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 88 PID 1948 wrote to memory of 4100 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 88 PID 1948 wrote to memory of 5116 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 96 PID 1948 wrote to memory of 5116 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 96 PID 1948 wrote to memory of 5116 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 96 PID 1948 wrote to memory of 1756 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 97 PID 1948 wrote to memory of 1756 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 97 PID 1948 wrote to memory of 1756 1948 08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver" /v DelayedAutoStart /t REG_DWORD /d 0 /f2⤵PID:4208
-
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d C:\Windows\system32\lld.cvsvres /f2⤵
- Server Software Component: Terminal Services DLL
PID:384
-
-
C:\Windows\SysWOW64\sc.exesc config lanmanserver start= auto2⤵
- Launches sc.exe
PID:4100
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\system32\lld.cvsvres StartUpA2⤵
- Loads dropped DLL
PID:5116
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe2⤵PID:1756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5e2b127da80c9f0e027562592b213766c
SHA1707576dd9620ac9646544996b01e6ced45639867
SHA2566e34e0e930c24a31b33ec48fb94d069e9c765b671f199852aecb0ea82616595e
SHA512971787891317e8533a19872621c0afcd491fd266b8663f5b6aa9508a05e0dcf586300274cbc5ae530e3bb56dded4a36505f6e2392b2431251dce5efbedf1f5bd
-
Filesize
24KB
MD5766c1ad36519f7e484c2effcfac292d6
SHA1657d6effaa6eaa63d0f4b45770f25fb8c85c73e4
SHA25645157cc3e155fe7c3b42e2ef4adfc9ed227793f6f3414a89e18a5f761032cfb6
SHA5125547628a31dd8ae53aab76bddd34c9328bedf2a0a08bd78b56ad903ac1e6e200e97ab9a1f92bc7fa601a091a04e08a0ea98491aa6efa53f296d609d45ff69998
-
Filesize
388KB
MD58d7db101a7211fe3309dc4dc8cf2dd0a
SHA16c2781eadf53b3742d16dab2f164baf813f7ac85
SHA25693db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
SHA5128b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83