Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 04:55
Static task
static1
Behavioral task
behavioral1
Sample
0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
-
Size
69KB
-
MD5
0ca59122f5d3a3853e67612a48df78ab
-
SHA1
23d167aa148010956ee0fdb19db0cf730b5608de
-
SHA256
097220ee85e37169d54e160276aaad25425636826facccd17ecbd5ab31d4d228
-
SHA512
b0701162232d645779a8672f535ff07e4286f36edf48a336fefb84ddc4437e5bd2b8be5d29f3bb9c2184ad4c4f0605f936b808101ab277ba6365a90aeb5bb12c
-
SSDEEP
1536:FNxU+W+73uSpoo3e/8+dcr2yS7yt0xzSjo+QQad:NU+W+qNo3e9Sy/K882
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\system32\\\\services.exe" 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tnaa30 = "C:\\Windows\\system32\\.exe" 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\W\tnaa30.exe 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\J\servicess.exe 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\J\mirror.exe 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\J\mirror.exe 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\J\netdhcp.exe 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\J\netdhcp.exe 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\J 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\W 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\J\scservice.exe 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\J\scservice.exe 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\W\tnaa30.exe 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\J\servicess.exe 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3236 0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0ca59122f5d3a3853e67612a48df78ab_JaffaCakes118.exe"1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3236
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4500,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:81⤵PID:4984
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD5850d201583b415916fd82a1c1824dc18
SHA1cf9dfcb04ca5c14414e8c3196c8a60b2171d637c
SHA2564e3f8d85557559da455e672ef0953b53938ea604295254d284f9699960af21c9
SHA51205bad3536b5d09a84f7bb4371b3494d079ce895cb775d31fefb4ef55ea27089bd7678a1a5f154bdc0bc6816f7e79c7f1e2fd4d289bc0ffc284f5c0fbac74ed2d