Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 11:47
Static task
static1
Behavioral task
behavioral1
Sample
0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe
-
Size
164KB
-
MD5
0df3318d819d9ad6ebd2a967f1e98813
-
SHA1
5072f8aed37a42d820ba58472dfc48ba02dad908
-
SHA256
286c8d67eac594e9b15b554607c9c8a9a3c72cc99c0d7a62e15b74c9ec5a3253
-
SHA512
2a1366573abcea264470ef34a1c38319db5d65d9260943751943571bd18ba84fc6768d9453b37be8aed843039ff5fff8f365b7fa9fe425d45051207668e3a501
-
SSDEEP
3072:h8JoE0ABLF7U9/IjKZcg3T4pxyLaQFiAXCgRdAesXGDQghH/cE:UiWFGcg6AiIRuBXAf
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\D8A9C\\FD2BC.exe" 0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3176-2-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral2/memory/3176-3-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/2520-14-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/2520-15-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/2520-17-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3176-18-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/964-194-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/964-196-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3176-197-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3176-198-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral2/memory/3176-310-0x0000000000400000-0x0000000000491000-memory.dmp upx -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3176 wrote to memory of 2520 3176 0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe 92 PID 3176 wrote to memory of 2520 3176 0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe 92 PID 3176 wrote to memory of 2520 3176 0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe 92 PID 3176 wrote to memory of 964 3176 0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe 98 PID 3176 wrote to memory of 964 3176 0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe 98 PID 3176 wrote to memory of 964 3176 0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe startC:\Program Files (x86)\LP\BC6D\396.exe%C:\Program Files (x86)\LP\BC6D2⤵PID:2520
-
-
C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe startC:\Program Files (x86)\9C5A3\lvvm.exe%C:\Program Files (x86)\9C5A32⤵PID:964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3168 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:4488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD50eed4be1e009f8234b12186f0e751945
SHA1e919e7a8137f76cf9ba2ce9115a6af6a604fefb2
SHA2567846a64eab20d1b0c18f4f3f6d5eeb78e8c798782a6abc6136f7cb608c2e9e2b
SHA512d8b9ec5dd176a57b69f34f3efffeb01f6b8c8b34fc85098f070484d73f7fd27b64b6cdbb580322a4a7511be6c13e43b937f096df148cee05a26dd69bd0a96d3d
-
Filesize
600B
MD558af57985f6ccea257658f2911252cd5
SHA1e6dcc622f78ce7afa174fb8c471ff7fe000fe86b
SHA2560eb17eb931d09065947aa381f84599c7e537e483ed7eaf5a299c552a5355d868
SHA51225ef335a63beb0092227dff2522f0b1237e2ecf9d1891e2bc2156db557ce034a65b3785f630a5e7cd17b215b2c6a7a74b4e10718ad55b37ab24e60e0881f3a3e