Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
68s -
max time network
77s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 16:03
Behavioral task
behavioral1
Sample
0eaebe9aa95788c6fbfe570d1a986dfd_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0eaebe9aa95788c6fbfe570d1a986dfd_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0eaebe9aa95788c6fbfe570d1a986dfd_JaffaCakes118.exe
-
Size
185KB
-
MD5
0eaebe9aa95788c6fbfe570d1a986dfd
-
SHA1
8c6d5609779326fd9398db05122a3d392467b126
-
SHA256
90e7d7234a5fc1f13c68fceeaa9976afd47e4e34646a0237142c06c1b3eb1de9
-
SHA512
2d3c5e72af7a77ac0c29a8651c472a5b0a0e821222430a5180541f4999552db99150e723e994df7e90f53ab930fb4b3e05834462c1397c6056eb4b3064d75d25
-
SSDEEP
3072:vjRCAaxsoW5V453B0oyS6Dck1uckBH1zRIR89mXfFxBEIIQjYa2GTDAk9g0CsJ/P:vlCfsoW4FKA6jSjWgqnBEToTDAkgsRS0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4792 Egeqaa.exe -
resource yara_rule behavioral2/memory/3028-0-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/files/0x00090000000233fc-14.dat upx behavioral2/memory/4792-16-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Egeqaa.exe 0eaebe9aa95788c6fbfe570d1a986dfd_JaffaCakes118.exe File opened for modification C:\Windows\Egeqaa.exe 0eaebe9aa95788c6fbfe570d1a986dfd_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 20172 4792 WerFault.exe 81 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main Egeqaa.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe 4792 Egeqaa.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3028 wrote to memory of 4792 3028 0eaebe9aa95788c6fbfe570d1a986dfd_JaffaCakes118.exe 81 PID 3028 wrote to memory of 4792 3028 0eaebe9aa95788c6fbfe570d1a986dfd_JaffaCakes118.exe 81 PID 3028 wrote to memory of 4792 3028 0eaebe9aa95788c6fbfe570d1a986dfd_JaffaCakes118.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\0eaebe9aa95788c6fbfe570d1a986dfd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0eaebe9aa95788c6fbfe570d1a986dfd_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\Egeqaa.exeC:\Windows\Egeqaa.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:4792 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 5843⤵
- Program crash
PID:20172
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4792 -ip 47921⤵PID:15912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
185KB
MD50eaebe9aa95788c6fbfe570d1a986dfd
SHA18c6d5609779326fd9398db05122a3d392467b126
SHA25690e7d7234a5fc1f13c68fceeaa9976afd47e4e34646a0237142c06c1b3eb1de9
SHA5122d3c5e72af7a77ac0c29a8651c472a5b0a0e821222430a5180541f4999552db99150e723e994df7e90f53ab930fb4b3e05834462c1397c6056eb4b3064d75d25