Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 08:32
Static task
static1
Behavioral task
behavioral1
Sample
27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe
-
Size
60KB
-
MD5
27e89d64fdb9428c8ca148563e8f93f2
-
SHA1
00cb053ed929741dddcc2e29590cd1c979b62c13
-
SHA256
ecf453178861bcf7883eee354d2bd11e6ab4626d3059bad93d114ecd55d658f2
-
SHA512
b41daa3be5979ddd462bf39d0d1ee02955d3ad483b8054e669e6c241254033bb8843caac126893aace61fb3623f6d5cf7170f1070e53b2498012deec31b10f12
-
SSDEEP
1536:V3cpyORJLuB4P4AJJv4Romu/v4ptqrmX+lE8QG+G:V3c1fP4AJJv45Slwa
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe -
Loads dropped DLL 9 IoCs
pid Process 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\Internat Explorar\Desktop.ini 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe File opened for modification C:\Users\Public\Desktop\Internat Explorar\Desktop.ini 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\tbgw.ico 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe File opened for modification C:\Windows\tbgw.ico 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1840 wrote to memory of 3436 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 85 PID 1840 wrote to memory of 3436 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 85 PID 1840 wrote to memory of 3436 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 85 PID 1840 wrote to memory of 3440 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 86 PID 1840 wrote to memory of 3440 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 86 PID 1840 wrote to memory of 3440 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 86 PID 3440 wrote to memory of 3152 3440 cmd.exe 89 PID 3440 wrote to memory of 3152 3440 cmd.exe 89 PID 3440 wrote to memory of 3152 3440 cmd.exe 89 PID 1840 wrote to memory of 2964 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 91 PID 1840 wrote to memory of 2964 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 91 PID 1840 wrote to memory of 2964 1840 27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe 91 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3152 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27e89d64fdb9428c8ca148563e8f93f2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c move "C:\Users\Admin\AppData\Local\Temp\Internat Explorar" "C:\Users\Public\Desktop\Internat Explorar"2⤵PID:3436
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib "C:\Users\Public\Desktop\Internat Explorar" +s2⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Public\Desktop\Internat Explorar" +s3⤵
- Views/modifies file attributes
PID:3152
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\temp_tmp.bat" "2⤵PID:2964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5055f4f9260e07fc83f71877cbb7f4fad
SHA1a245131af1a182de99bd74af9ff1fab17977a72f
SHA2564209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc
SHA512a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
Filesize
214B
MD54262ace1550136418d1f2828bc2650d6
SHA13284abfb6fc572ddacc5b1c4a5b1d6ece4ff8848
SHA256bc5f323f53443ff48b73d2886434e166fd8c517af223116d0f6c3cbb3cec7e8c
SHA512b2fd4e4f1e73b3f1abc5caba005dce7fb011d92db502888c6fecb18b1598467598839140c159e456ccb3915e1ba7e98418e7fbedbad7716143a7bc078f1027d6
-
Filesize
1010B
MD50241624317d179d69afaf8bdd85e6603
SHA1293e70e2d3ef82aeaafb1edf0f4811290c8e10e6
SHA2563808e5ceae259f656b45361840daecff6c0e753a2e03cc490d7ce550ffb8b56f
SHA512806b249b8dc3d6865b96b5a63f1e0b74e2b783a2d58151ceadf5d3b53f66da666300bbde1c8c48a6b26d8c0e98ed60f4b50429b9770b251a34e91082dc2e0aab