Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 03:56
Static task
static1
Behavioral task
behavioral1
Sample
3336ad60a89c57c4610fb8a8b86b7d41_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3336ad60a89c57c4610fb8a8b86b7d41_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3336ad60a89c57c4610fb8a8b86b7d41_JaffaCakes118.exe
-
Size
125KB
-
MD5
3336ad60a89c57c4610fb8a8b86b7d41
-
SHA1
b165673ea521696c484253b00dc77c86206996b0
-
SHA256
d90abbe31bae6679d53ace97db1b0d4807e7b665c16d0653698695d47f91253e
-
SHA512
febfa796bdc0226e2e231333a141f27d19b7ee07ba2ccf674e2365bcd9181434a39c08a767e0906facaabf02b7dec5859df4d114ce89d1b3c97e115316f316f4
-
SSDEEP
3072:EJgwBIxhn+dz7diTqkGqcZBUPs7dHNnu3lAzyDJkluJfBd8V:EuwWx8fScnUPey1BtB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3448 Pviqea.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job 3336ad60a89c57c4610fb8a8b86b7d41_JaffaCakes118.exe File created C:\Windows\Pviqea.exe 3336ad60a89c57c4610fb8a8b86b7d41_JaffaCakes118.exe File opened for modification C:\Windows\Pviqea.exe 3336ad60a89c57c4610fb8a8b86b7d41_JaffaCakes118.exe File created C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job Pviqea.exe File opened for modification C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job Pviqea.exe File created C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job 3336ad60a89c57c4610fb8a8b86b7d41_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Main Pviqea.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\International Pviqea.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe 3448 Pviqea.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3820 wrote to memory of 3448 3820 3336ad60a89c57c4610fb8a8b86b7d41_JaffaCakes118.exe 84 PID 3820 wrote to memory of 3448 3820 3336ad60a89c57c4610fb8a8b86b7d41_JaffaCakes118.exe 84 PID 3820 wrote to memory of 3448 3820 3336ad60a89c57c4610fb8a8b86b7d41_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\3336ad60a89c57c4610fb8a8b86b7d41_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3336ad60a89c57c4610fb8a8b86b7d41_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\Pviqea.exeC:\Windows\Pviqea.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:3448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
125KB
MD53336ad60a89c57c4610fb8a8b86b7d41
SHA1b165673ea521696c484253b00dc77c86206996b0
SHA256d90abbe31bae6679d53ace97db1b0d4807e7b665c16d0653698695d47f91253e
SHA512febfa796bdc0226e2e231333a141f27d19b7ee07ba2ccf674e2365bcd9181434a39c08a767e0906facaabf02b7dec5859df4d114ce89d1b3c97e115316f316f4
-
Filesize
390B
MD52faf719198cf55be96deec610f6cdd9b
SHA1e1e0de2b00225cb7cc46febae4dde452f8b1b1aa
SHA2566c2e7475c2c4a79acd8e6e55c117ffd238cbe3359acb5b2c6f6f05b4f6fc94da
SHA512d2ed7a71214449dd896f37be30c6789e114a84ad95fecfbfd5f0733b684a70cbae81e3361816c268387d50152c409ca46b5a7616a033d01cf64741caaa91725a