Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe
-
Size
531KB
-
MD5
25169f1bb91480ade7e199647e85f60b
-
SHA1
15f91dc1b0bd697d11268d924c11e86d921a2ea3
-
SHA256
a663c747622cc5888d09d2664b722033fe8e044dccb9ca510918eb626d37fc32
-
SHA512
27ee8ddb6a26268e92d9fea6b4b560ed953f1397bd9d6b1a4bd72c307566147bdd38835e659d4f0c44b33a7a6ddd11005226de52a6ebb720d8104dfebaecd540
-
SSDEEP
12288:JZigw0DdDV0YPp4ZFwr7WNs8m4C6R91p4s/xioS:JZigw05V0U4Zyr7Wax6tp4Q
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2652 smsa.exe 3916 smsa.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 smsa.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE smsa.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies smsa.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 smsa.exe -
Modifies data under HKEY_USERS 16 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" smsa.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" smsa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix smsa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ smsa.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" smsa.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" smsa.exe Key created \REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer\Navigating\.Current smsa.exe Key created \REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer smsa.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1601 = "0" smsa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" smsa.exe Key created \REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps smsa.exe Key created \REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer\Navigating smsa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 smsa.exe Key created \REGISTRY\USER\.DEFAULT\AppEvents smsa.exe Key created \REGISTRY\USER\.DEFAULT\AppEvents\Schemes smsa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" smsa.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3916 smsa.exe 3916 smsa.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4468 wrote to memory of 2652 4468 25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe 82 PID 4468 wrote to memory of 2652 4468 25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe 82 PID 4468 wrote to memory of 2652 4468 25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe 82 PID 4468 wrote to memory of 4508 4468 25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe 84 PID 4468 wrote to memory of 4508 4468 25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe 84 PID 4468 wrote to memory of 4508 4468 25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\Recycle\smsa.exec:\Recycle\smsa.exe2⤵
- Executes dropped EXE
PID:2652
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\25169f1bb91480ade7e199647e85f60b_JaffaCakes118.bat2⤵PID:4508
-
-
\??\c:\Recycle\smsa.exec:\Recycle\smsa.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3916
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
531KB
MD525169f1bb91480ade7e199647e85f60b
SHA115f91dc1b0bd697d11268d924c11e86d921a2ea3
SHA256a663c747622cc5888d09d2664b722033fe8e044dccb9ca510918eb626d37fc32
SHA51227ee8ddb6a26268e92d9fea6b4b560ed953f1397bd9d6b1a4bd72c307566147bdd38835e659d4f0c44b33a7a6ddd11005226de52a6ebb720d8104dfebaecd540
-
Filesize
224B
MD5250837a2e5a1a08e777548ee2b5b874e
SHA13b2d7adf9e52ed4c2794c1349861f5f877ee4a09
SHA25657dd125dec82d4dc606d149b57f70836a1017e339e63c1783b8a6968992cf084
SHA512b3636374a61763dd6e37ae1e82930d9479a4222666bc2ba2557f1bf4e0d1d5e8ca484af9bdf4c4672c019357df017fff5030a4b3a2d17960b074d08afe48c663