Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 04:04
Static task
static1
Behavioral task
behavioral1
Sample
0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe
-
Size
728KB
-
MD5
0c719df8dc567acf2d89cc11ea18af8f
-
SHA1
cdf90a6f3e4da197b81d6c3a082ebc978e955441
-
SHA256
fa5b86cfb245baee31cb5a23be3000f435503646de17a43c2a72128ab0e792e8
-
SHA512
ba6c7e957fb596636cb94512bdef774154dc89d14416b39e702b9772b645f0602f2524e5642228dfeefd3dde850875e46f3f0224848ac5507a5466a0ece64b0e
-
SSDEEP
12288:lEcF8D2K53tGcAOYYsLN2Z8bbXf/meGDgGeItoEc9GspWZhASRXHYnrmh:lEc8H5fMLN2Kb7frGlFtov9GsqRXHYr+
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1888 netsh.exe 1560 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3108 wrote to memory of 4736 3108 0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe 81 PID 3108 wrote to memory of 4736 3108 0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe 81 PID 3108 wrote to memory of 4736 3108 0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe 81 PID 3108 wrote to memory of 2544 3108 0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe 83 PID 3108 wrote to memory of 2544 3108 0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe 83 PID 3108 wrote to memory of 2544 3108 0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe 83 PID 3108 wrote to memory of 2580 3108 0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe 85 PID 3108 wrote to memory of 2580 3108 0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe 85 PID 3108 wrote to memory of 2580 3108 0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe 85 PID 2580 wrote to memory of 1560 2580 cmd.exe 87 PID 2580 wrote to memory of 1560 2580 cmd.exe 87 PID 2580 wrote to memory of 1560 2580 cmd.exe 87 PID 3108 wrote to memory of 4248 3108 0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe 88 PID 3108 wrote to memory of 4248 3108 0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe 88 PID 3108 wrote to memory of 4248 3108 0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe 88 PID 4248 wrote to memory of 1888 4248 cmd.exe 90 PID 4248 wrote to memory of 1888 4248 cmd.exe 90 PID 4248 wrote to memory of 1888 4248 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0c719df8dc567acf2d89cc11ea18af8f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"2⤵PID:4736
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵PID:2544
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1560
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE2⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1888
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7B
MD5824ab679eea19c5b43b186800c2c625f
SHA1f8b90bc89117ac4f1a272e7acef952a79a64b617
SHA256f6d4a23bd6b412e4d4906cbd1c56dcbcf5ddd96b6a9098ceba96be94e52f7ab3
SHA512e13bb9c005c2acb412916bf0f4a37b39c2800298042d5344b877143d1b767342903c9bb3e8d4eda75f37cc323b5f623d6bf34629d2c999c7df316de4ffd3caf4