Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 07:59
Static task
static1
Behavioral task
behavioral1
Sample
2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
-
Size
70KB
-
MD5
2532c567fc22c68524d1fa9ba2345164
-
SHA1
7f5b2106c5c1e2a99a05acb6b58f216b37396c7f
-
SHA256
18b6f2fa21221a9de5a62dfa194ed7a8f15fcb7eb42beb618ccd8c1e69d090af
-
SHA512
263113fe93c0f77e4ac4795a642c336e36e3b49b7fa10567f78ce3c947d0705f1ca04aa3f4a27f109ad88e09cb7360c97741af135b9e59ed235f04ed9a3b7cac
-
SSDEEP
1536:R41IOJC/HwmjeFAuHL6B1xVJO6i4HQoe0FB58:i1dqSf0/OYHe
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "kdgvb.exe" 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\kdgvb.exe 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe File created C:\Windows\SysWOW64\kdgvb.exe 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2136 set thread context of 4488 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe 87 -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeSecurityPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeSystemtimePrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeBackupPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeRestorePrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeShutdownPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeDebugPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeUndockPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeManageVolumePrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeImpersonatePrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: 33 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: 34 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: 35 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe Token: 36 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2556 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe 86 PID 2136 wrote to memory of 2556 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe 86 PID 2136 wrote to memory of 4488 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe 87 PID 2136 wrote to memory of 4488 2136 2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe2⤵PID:2556
-
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe2⤵PID:4488
-