Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 04:34
Static task
static1
Behavioral task
behavioral1
Sample
2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
General
-
Target
2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe
-
Size
56KB
-
MD5
2f01e472eea6c00978e7656e02603bd0
-
SHA1
0c4d4263345ca631ab734a7326fa2eba6d61d366
-
SHA256
edc3909319b8c68a4c7c5d2b1f09edf7071086a1bc6b7734129d5e28f694c2af
-
SHA512
05a4547b051727b71efc387337fd0e5ce5eaf7b34b68153a4207a6e473af874e02aed488f7ab159be1bf0f7580b07e3c30c155df38c616d04f63c6353feac6be
-
SSDEEP
768:AtEZo9nSBRSxHZX0SgxzB6I0alAe4SiLpWi6fXRBAjDk38/jf:eH9SqB0/Aq5cl6TuYOjf
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/3944-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3944-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3944-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3944-7-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3584 set thread context of 3944 3584 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe 3944 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3584 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3584 wrote to memory of 3944 3584 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe 85 PID 3584 wrote to memory of 3944 3584 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe 85 PID 3584 wrote to memory of 3944 3584 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe 85 PID 3584 wrote to memory of 3944 3584 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe 85 PID 3584 wrote to memory of 3944 3584 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe 85 PID 3584 wrote to memory of 3944 3584 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe 85 PID 3584 wrote to memory of 3944 3584 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe 85 PID 3584 wrote to memory of 3944 3584 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe 85 PID 3584 wrote to memory of 4176 3584 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe 86 PID 3584 wrote to memory of 4176 3584 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe 86 PID 3584 wrote to memory of 4176 3584 2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f01e472eea6c00978e7656e02603bd0_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a.bat" "2⤵PID:4176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176B
MD5b6050d36fbbaba7e0f299f7602013907
SHA16ec26fafae1262ab8a6779e3ffe85986a2acf311
SHA256de5f52ce08a1e962ba6fb1936a2110ec4822eae04005a722bf7fd0f974bc32cc
SHA51288b852ecebce88ddab928b5c1254b6bde8524d29f591d4df5674605cfb8d4a874565cc124c0813b1b7f4a4d2a3381bdb87fa4f5ce4fac07b38e675fad5140cf5