Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 16:13
Static task
static1
Behavioral task
behavioral1
Sample
22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe
-
Size
169KB
-
MD5
22ff1acf1a6c7ecafdb0d5a686e457d6
-
SHA1
bb8e192ab0e2efedf6d3cc8c9744690c0e26ff5f
-
SHA256
da1ff72421209a3df6153b87b27f7e1a24e9ad6d2c2cb990fb51bce1cd1c4c9c
-
SHA512
6f120002ced4ef2fb93e91853660fec44ebc6643d6f29a60cd1524cb9a2ba9560538fef9d822c3207728bac7a148f495e1926f3649e33fbf36d48f637af9afa8
-
SSDEEP
3072:XbUsNSk+dpN2goBw69Non3iXMtvWJqRAq5e7G7VO8rhJZz2UXEvEr9RGBkuu46:AvjN2rnSyXYWf7+VOqh1XEvE9RF46
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3024 B6232F3AFB2.exe 4348 0fiF760.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3752-1-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/3752-2-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/3752-10-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/3024-14-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/3024-13-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/3024-23-0x0000000000400000-0x0000000000461000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4Y3Y0C3AUF7W0VXWEALHPX = "C:\\Recycle.Bin\\B6232F3AFB2.exe /q" 0fiF760.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 3080 3752 WerFault.exe 89 3248 3024 WerFault.exe 93 -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\PhishingFilter 0fiF760.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" 0fiF760.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0" 0fiF760.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Recovery 0fiF760.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0" 0fiF760.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3752 22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe 3752 22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe 3752 22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe 3752 22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe 3024 B6232F3AFB2.exe 3024 B6232F3AFB2.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe 4348 0fiF760.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3752 22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe Token: SeDebugPrivilege 3752 22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe Token: SeDebugPrivilege 3752 22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe Token: SeDebugPrivilege 3752 22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe Token: SeDebugPrivilege 3024 B6232F3AFB2.exe Token: SeDebugPrivilege 3024 B6232F3AFB2.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe Token: SeDebugPrivilege 4348 0fiF760.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3752 wrote to memory of 3024 3752 22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe 93 PID 3752 wrote to memory of 3024 3752 22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe 93 PID 3752 wrote to memory of 3024 3752 22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe 93 PID 3024 wrote to memory of 4348 3024 B6232F3AFB2.exe 96 PID 3024 wrote to memory of 4348 3024 B6232F3AFB2.exe 96 PID 3024 wrote to memory of 4348 3024 B6232F3AFB2.exe 96 PID 3024 wrote to memory of 4348 3024 B6232F3AFB2.exe 96 PID 3024 wrote to memory of 4348 3024 B6232F3AFB2.exe 96 PID 4348 wrote to memory of 3752 4348 0fiF760.exe 89 PID 4348 wrote to memory of 3752 4348 0fiF760.exe 89 PID 4348 wrote to memory of 3752 4348 0fiF760.exe 89 PID 4348 wrote to memory of 3752 4348 0fiF760.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 2802⤵
- Program crash
PID:3080
-
-
C:\Recycle.Bin\B6232F3AFB2.exe"C:\Recycle.Bin\B6232F3AFB2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 2803⤵
- Program crash
PID:3248
-
-
C:\Users\Admin\AppData\Local\Temp\0fiF760.exe"C:\Users\Admin\AppData\Local\Temp\0fiF760.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3752 -ip 37521⤵PID:4872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3024 -ip 30241⤵PID:4480
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:81⤵PID:3116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD522ff1acf1a6c7ecafdb0d5a686e457d6
SHA1bb8e192ab0e2efedf6d3cc8c9744690c0e26ff5f
SHA256da1ff72421209a3df6153b87b27f7e1a24e9ad6d2c2cb990fb51bce1cd1c4c9c
SHA5126f120002ced4ef2fb93e91853660fec44ebc6643d6f29a60cd1524cb9a2ba9560538fef9d822c3207728bac7a148f495e1926f3649e33fbf36d48f637af9afa8
-
Filesize
9KB
MD5a684fffd28414e1d28837adce0f8aac1
SHA1d0c391c7064d1343288edae77cde798635585145
SHA256f341c79fbeb18b9790c73c45672af6d822705042c59699e72e7e90a37c6077bc
SHA512233dc56d1738ac7f118d087607395a0e8bfd9280ed1a005dda4cf95137983b2d426ad91d9bc89932f15d86fd3be4c7c25b2577e7012518e956a598f08e8b4dc1
-
Filesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be