Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
69s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 21:01
Static task
static1
Behavioral task
behavioral1
Sample
26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe
-
Size
416KB
-
MD5
26327da6e573339b69f246faa5d61a02
-
SHA1
2ab4b6cf42e8b52fed191f557a2eda8dd7d9aa98
-
SHA256
ffd87244c6ba0b9fd449d8c3e80a3140db91f0128deb629163a6a21a0eaabf3d
-
SHA512
3b941a5631040d26a299e75960fe9d0e7332dfc6414cb6da78de13208115b2746cea483e90639b2de5afb87455ec80e23e70b3d1c0f6a6e25c758d52b8170b32
-
SSDEEP
6144:s6b2I7dBJY+l8EAnddMJfnDnDYiktjAg2SDj2uqLUITtjtz:s6qIprYLsr0iktjrpDSFJ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4280 bNkMoNl12804.exe -
Executes dropped EXE 1 IoCs
pid Process 4280 bNkMoNl12804.exe -
resource yara_rule behavioral2/memory/1716-3-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/1716-4-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/1716-5-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/4280-18-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/4280-17-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/1716-21-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/4280-22-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/4280-34-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/1716-41-0x0000000000400000-0x00000000004B3000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bNkMoNl12804 = "C:\\ProgramData\\bNkMoNl12804\\bNkMoNl12804.exe" bNkMoNl12804.exe -
Program crash 27 IoCs
pid pid_target Process procid_target 3968 1716 WerFault.exe 82 5104 1716 WerFault.exe 82 2664 1716 WerFault.exe 82 980 4280 WerFault.exe 86 2416 1716 WerFault.exe 82 2984 4280 WerFault.exe 86 2756 1716 WerFault.exe 82 2568 4280 WerFault.exe 86 2712 1716 WerFault.exe 82 4976 4280 WerFault.exe 86 3380 4280 WerFault.exe 86 5072 1716 WerFault.exe 82 2128 4280 WerFault.exe 86 644 1716 WerFault.exe 82 3740 4280 WerFault.exe 86 4236 4280 WerFault.exe 86 1712 4280 WerFault.exe 86 1484 4280 WerFault.exe 86 2236 4280 WerFault.exe 86 3868 4280 WerFault.exe 86 4352 4280 WerFault.exe 86 3728 4280 WerFault.exe 86 2108 4280 WerFault.exe 86 432 1716 WerFault.exe 82 2756 1716 WerFault.exe 82 4036 4280 WerFault.exe 86 1028 4280 WerFault.exe 86 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 4280 bNkMoNl12804.exe 4280 bNkMoNl12804.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 4280 bNkMoNl12804.exe 4280 bNkMoNl12804.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 4280 bNkMoNl12804.exe 4280 bNkMoNl12804.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 4280 bNkMoNl12804.exe 4280 bNkMoNl12804.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 4280 bNkMoNl12804.exe 4280 bNkMoNl12804.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 4280 bNkMoNl12804.exe 4280 bNkMoNl12804.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 4280 bNkMoNl12804.exe 4280 bNkMoNl12804.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 4280 bNkMoNl12804.exe 4280 bNkMoNl12804.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 4280 bNkMoNl12804.exe 4280 bNkMoNl12804.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 4280 bNkMoNl12804.exe 4280 bNkMoNl12804.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe Token: SeDebugPrivilege 4280 bNkMoNl12804.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4280 bNkMoNl12804.exe 4280 bNkMoNl12804.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4280 bNkMoNl12804.exe 4280 bNkMoNl12804.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4280 bNkMoNl12804.exe 4280 bNkMoNl12804.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1716 wrote to memory of 4280 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 86 PID 1716 wrote to memory of 4280 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 86 PID 1716 wrote to memory of 4280 1716 26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 6082⤵
- Program crash
PID:3968
-
-
C:\ProgramData\bNkMoNl12804\bNkMoNl12804.exe"C:\ProgramData\bNkMoNl12804\bNkMoNl12804.exe" "C:\Users\Admin\AppData\Local\Temp\26327da6e573339b69f246faa5d61a02_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4280 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 7323⤵
- Program crash
PID:980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 7403⤵
- Program crash
PID:2984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 7403⤵
- Program crash
PID:2568
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 8163⤵
- Program crash
PID:4976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 8243⤵
- Program crash
PID:3380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 9803⤵
- Program crash
PID:2128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 10123⤵
- Program crash
PID:3740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 12003⤵
- Program crash
PID:4236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 13923⤵
- Program crash
PID:1712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 16043⤵
- Program crash
PID:1484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 9283⤵
- Program crash
PID:2236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 6403⤵
- Program crash
PID:3868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 16803⤵
- Program crash
PID:4352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 17923⤵
- Program crash
PID:3728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 18003⤵
- Program crash
PID:2108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 11563⤵
- Program crash
PID:4036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 7363⤵
- Program crash
PID:1028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 6082⤵
- Program crash
PID:5104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 7922⤵
- Program crash
PID:2664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 8002⤵
- Program crash
PID:2416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 8002⤵
- Program crash
PID:2756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 8282⤵
- Program crash
PID:2712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 9682⤵
- Program crash
PID:5072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 10282⤵
- Program crash
PID:644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 6522⤵
- Program crash
PID:432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 1402⤵
- Program crash
PID:2756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1716 -ip 17161⤵PID:3728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1716 -ip 17161⤵PID:5020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1716 -ip 17161⤵PID:1072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4280 -ip 42801⤵PID:2332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1716 -ip 17161⤵PID:4040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4280 -ip 42801⤵PID:3388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1716 -ip 17161⤵PID:2096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4280 -ip 42801⤵PID:2140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1716 -ip 17161⤵PID:2012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4280 -ip 42801⤵PID:4180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4280 -ip 42801⤵PID:4032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1716 -ip 17161⤵PID:2156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4280 -ip 42801⤵PID:4472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1716 -ip 17161⤵PID:4652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4280 -ip 42801⤵PID:4044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4280 -ip 42801⤵PID:2468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4280 -ip 42801⤵PID:3240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4280 -ip 42801⤵PID:4836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4280 -ip 42801⤵PID:1900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4280 -ip 42801⤵PID:1916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4280 -ip 42801⤵PID:1544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4280 -ip 42801⤵PID:4268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4280 -ip 42801⤵PID:4344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1716 -ip 17161⤵PID:2416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1716 -ip 17161⤵PID:3784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4280 -ip 42801⤵PID:3288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4280 -ip 42801⤵PID:3512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
416KB
MD55fe84ae7386b048301c908997c3df528
SHA109a6f4da5a147c690e4f9a8719b7e051501fffef
SHA256130a4a0df47417be64807e205ce865a34563620145aec51363cd2e16d1d6d87f
SHA512e823a9cbb95aab6480d7f5e933625f1842e1c7857a23ec4117272fceb41411fa1660409d189cc8714552386eec83a7fb2dc5ff86e5d4f112df1a01cc7e326531