Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 00:19
Static task
static1
Behavioral task
behavioral1
Sample
14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe
-
Size
76KB
-
MD5
14027e0ce5802da4aee2de0b0c6bc5c5
-
SHA1
6e019b42832f1553b65f663f2f11d54cf9d29b8c
-
SHA256
da456185d5879d75d08c149b51b5b1c7a4efea4cccf54c45643f34a1db6d0a1b
-
SHA512
3eaeb94b4b9c27128ca135eeb0c101576c5e25b9a2a1b3a1564fabfe9be8d891081fe5136a9d78e4c1e301b15ce339237653b7fb1b4ecfbb60dd40c32d30ef34
-
SSDEEP
768:PT5rXSibDwmKK57jI0MbJvuIcCBkoAWUZMKyzWYuzBHFzsP8VrYdbHiB991oIkfC:PFrCGDc7/BxqhhFtVrYVqoI0/oz
Malware Config
Signatures
-
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 2912 cmd.exe -
Kills process with taskkill 1 IoCs
pid Process 3748 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3748 taskkill.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1624 wrote to memory of 1608 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 81 PID 1624 wrote to memory of 1608 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 81 PID 1624 wrote to memory of 1608 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 81 PID 1624 wrote to memory of 4604 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 82 PID 1624 wrote to memory of 4604 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 82 PID 1624 wrote to memory of 4604 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 82 PID 1624 wrote to memory of 2912 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 83 PID 1624 wrote to memory of 2912 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 83 PID 1624 wrote to memory of 2912 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 83 PID 2912 wrote to memory of 2972 2912 cmd.exe 84 PID 2912 wrote to memory of 2972 2912 cmd.exe 84 PID 2912 wrote to memory of 2972 2912 cmd.exe 84 PID 1624 wrote to memory of 3032 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 85 PID 1624 wrote to memory of 3032 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 85 PID 1624 wrote to memory of 3032 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 85 PID 1624 wrote to memory of 2672 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 86 PID 1624 wrote to memory of 2672 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 86 PID 1624 wrote to memory of 2672 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 86 PID 1624 wrote to memory of 2348 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 89 PID 1624 wrote to memory of 2348 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 89 PID 1624 wrote to memory of 2348 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 89 PID 1624 wrote to memory of 4780 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 93 PID 1624 wrote to memory of 4780 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 93 PID 1624 wrote to memory of 4780 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 93 PID 1624 wrote to memory of 1832 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 96 PID 1624 wrote to memory of 1832 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 96 PID 1624 wrote to memory of 1832 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 96 PID 1624 wrote to memory of 2124 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 97 PID 1624 wrote to memory of 2124 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 97 PID 1624 wrote to memory of 2124 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 97 PID 1624 wrote to memory of 1936 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 98 PID 1624 wrote to memory of 1936 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 98 PID 1624 wrote to memory of 1936 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 98 PID 1624 wrote to memory of 4512 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 99 PID 1624 wrote to memory of 4512 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 99 PID 1624 wrote to memory of 4512 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 99 PID 1624 wrote to memory of 2152 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 100 PID 1624 wrote to memory of 2152 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 100 PID 1624 wrote to memory of 2152 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 100 PID 2152 wrote to memory of 3748 2152 cmd.exe 101 PID 2152 wrote to memory of 3748 2152 cmd.exe 101 PID 2152 wrote to memory of 3748 2152 cmd.exe 101 PID 1624 wrote to memory of 552 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 102 PID 1624 wrote to memory of 552 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 102 PID 1624 wrote to memory of 552 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 102 PID 1624 wrote to memory of 2600 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 103 PID 1624 wrote to memory of 2600 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 103 PID 1624 wrote to memory of 2600 1624 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 103 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2972 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"2⤵PID:1608
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\ztmp" mkdir "C:\Users\Admin\AppData\Local\Temp\ztmp"2⤵PID:4604
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\ztmp2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\attrib.exeattrib +h C:\Users\Admin\AppData\Local\Temp\ztmp3⤵
- Views/modifies file attributes
PID:2972
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2672
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2348
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1832
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2124
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp44355.bat" del "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp44355.bat"2⤵PID:1936
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp80055.exe" del "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp80055.exe"2⤵PID:4512
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ztmp\tmp44355.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3748
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp44355.bat" del "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp44355.bat"2⤵PID:552
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp80055.exe" del "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp80055.exe"2⤵PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
270B
MD5ae1c6565f6b0e9ef871ca43416ac8c57
SHA143539d1673515010b715271874b8fc9d51ba8ea4
SHA2569fa1bf8c8b5b62efbc392df5d47030055b0c39c73b70c9f2edddc0eb46cc8a6f
SHA5124e64e902d3c13b21adedbae0a133588ff948d60d18752fb4ee3ac04f31e39362d3dbc978467461763c17f243f435902806ada8b8b4c47b226b9a442d628241aa
-
Filesize
15B
MD53c52638971ead82b5929d605c1314ee0
SHA17318148a40faca203ac402dff51bbb04e638545c
SHA2565614459ec05fdf6110fa8ce54c34e859671eeffba2b7bb4b1ad6c2c6706855ab
SHA51246f85f730e3ca9a57f51416c6ab4d03f868f895568eee8f7943cd249b2f71d2a3e83c34e7132715c983d3efaa865a9cb599a4278c911130a0a6948a535c0573b