Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 15:55
Static task
static1
Behavioral task
behavioral1
Sample
28bc1957a358ee387f38a9ab87c9406f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
28bc1957a358ee387f38a9ab87c9406f_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
28bc1957a358ee387f38a9ab87c9406f_JaffaCakes118.exe
-
Size
344KB
-
MD5
28bc1957a358ee387f38a9ab87c9406f
-
SHA1
243a4444f83fbf612811209d49c3c31be440c4bf
-
SHA256
a07f59f98713dac3d1fca666589763e9408d9ddf559e642682fbde2873f7c953
-
SHA512
454b593389cc6cbd5e64a1693de48de6267011fce1824557764b9f521f09f98bd560e4948932722e4903e7ec2a4d63057be15e6136c360253bc3aeba7b98d288
-
SSDEEP
6144:a8u1ZcjmBY+Msn4A6ne9OV8GPSkFFVc+5Ny84mSK/srm9Le/FXn:WcjG7fWeUV8ex664kKYLun
Malware Config
Signatures
-
Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State = "146944" UmEzI970vMFh.exe -
resource yara_rule behavioral2/memory/5048-1-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/2184-4-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral2/memory/2184-5-0x0000000000400000-0x00000000004D7000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\UmEzI970vMFh UmEzI970vMFh.exe File opened for modification C:\PROGRA~3\UmEzI970vMFh UmEzI970vMFh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Internet Explorer\Main UmEzI970vMFh.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" UmEzI970vMFh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 5048 28bc1957a358ee387f38a9ab87c9406f_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2184 UmEzI970vMFh.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 5048 28bc1957a358ee387f38a9ab87c9406f_JaffaCakes118.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe 2184 UmEzI970vMFh.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5048 wrote to memory of 2184 5048 28bc1957a358ee387f38a9ab87c9406f_JaffaCakes118.exe 93 PID 5048 wrote to memory of 2184 5048 28bc1957a358ee387f38a9ab87c9406f_JaffaCakes118.exe 93 PID 5048 wrote to memory of 2184 5048 28bc1957a358ee387f38a9ab87c9406f_JaffaCakes118.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\28bc1957a358ee387f38a9ab87c9406f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\28bc1957a358ee387f38a9ab87c9406f_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\PROGRA~3\UmEzI970vMFh.exeC:\PROGRA~3\UmEzI970vMFh.exe2⤵
- Manipulates Digital Signatures
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4552,i,15168044379859864039,3380316340477469860,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:81⤵PID:4084