Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
2c55296854a479bc3a4424fccc936777_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2c55296854a479bc3a4424fccc936777_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2c55296854a479bc3a4424fccc936777_JaffaCakes118.exe
-
Size
245KB
-
MD5
2c55296854a479bc3a4424fccc936777
-
SHA1
c8d0923edd2945d8c7cf6bb45dafd24f1cef49c3
-
SHA256
85c12695e55bf807ab94c32775c331925dbf2aa8c260ac411720c885936b3da9
-
SHA512
657dce9f88d5d54ccc97be99a86d1f5ece979282a7e2dbb1d0ac34bae0c945c27dba07c9a17639fe453ca05cc4d0491acc72ab3f4e35b219db00f2884eb1a46d
-
SSDEEP
6144:ZcWMJJhqryYP/daq72SeNckyNOmWp7fkQdpeKZ:ZczJJhqrVPlOSeNclNJWpzvYe
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation 2c55296854a479bc3a4424fccc936777_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1688 sffer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1688 sffer.exe 1688 sffer.exe 1688 sffer.exe 1688 sffer.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4052 wrote to memory of 1688 4052 2c55296854a479bc3a4424fccc936777_JaffaCakes118.exe 92 PID 4052 wrote to memory of 1688 4052 2c55296854a479bc3a4424fccc936777_JaffaCakes118.exe 92 PID 4052 wrote to memory of 1688 4052 2c55296854a479bc3a4424fccc936777_JaffaCakes118.exe 92 PID 1688 wrote to memory of 3428 1688 sffer.exe 56 PID 1688 wrote to memory of 3428 1688 sffer.exe 56 PID 1688 wrote to memory of 3428 1688 sffer.exe 56 PID 1688 wrote to memory of 3428 1688 sffer.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\2c55296854a479bc3a4424fccc936777_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2c55296854a479bc3a4424fccc936777_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\sffer.exe"C:\Users\Admin\AppData\Local\Temp\sffer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4136,i,3027467512973953085,11878940668304988630,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:81⤵PID:1808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
161KB
MD59cf1e593612130d008e6d14f20fdb8a8
SHA1544fd2ca92534abf6734109646fb0624d69afe28
SHA2562b2b22f904ba7de1de4fdebce13da0d4281e70de7aa206ee58049712f75d64de
SHA512fc09589857506e5145ea05f530098b0449aa82cf71f61332413837bd7316a4372253b20d4cd09627e3233d17c8ea09afe6880e06dcf53c9653e57117c614c22b