Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 04:51
Static task
static1
Behavioral task
behavioral1
Sample
335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe
-
Size
34KB
-
MD5
335bfcbe99d4267a35c737c79b2810cc
-
SHA1
4b856dcc3e4918a3a5102b778eacde0ec1fbb669
-
SHA256
b6382f9c2d9982d942c7759e6f3b2d8524cce520227cecea8fa69a103d64698f
-
SHA512
6695992c1d413e0a62214f29a9ce8f544c0bad2debd93867a333be23e55e20fbbda3df07e6b7613b6b00ba8c19ef80da4fa3ae66d0ce6d1b7f96aba7494f7450
-
SSDEEP
768:cflivXrVKpVhKvtxwYHwVFoeAQGmucwU9:ylqrVKprVuQGq
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2744 jusched.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\1b59bdbb\jusched.exe 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe File created C:\Program Files (x86)\1b59bdbb\1b59bdbb 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe 2744 jusched.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4936 wrote to memory of 2744 4936 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe 84 PID 4936 wrote to memory of 2744 4936 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe 84 PID 4936 wrote to memory of 2744 4936 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Program Files (x86)\1b59bdbb\jusched.exe"C:\Program Files (x86)\1b59bdbb\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
34KB
MD52375d7eac037e2db78d51819ef39f19e
SHA18e08c54c81cc2f335b8beae7cd35c9f94dee1d5f
SHA256e992b21a4a3601a409c4f3c463dd58678e02249df6e5a411484b9f7d63a86c61
SHA512fefa6def4118ef8d10bec78c9f4a6b1b7366926d68809df3b660b183000b5807b55968e45a8d9c3ec7bd208e531b050e519115be8aa12511db614c4635b8218f