Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 19:22
Behavioral task
behavioral1
Sample
3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe
-
Size
20KB
-
MD5
3a6e80c3c8c123e2b0549e6d6b980dff
-
SHA1
f85bf93e05379c7f43bfcf2eb59a84cc047f0135
-
SHA256
438fc9b1f075a5a3e8bc3ee46ba5b073320199f8d574bac862cf553bdbf82626
-
SHA512
481b5a9e29490324544f0a0defe5930e0e965b5ee1e36cb724d6a0e0949b20754ffa05543aa6a84b2e6a4ed7c992c48d7862aa69b093d2ad0fd9432ee29da808
-
SSDEEP
384:Swx+yPRfIABTUHwPpv6mGBUaZTAhZWPTA4GwUBGCtXlorbB/DWpk8gUQT+ljM:Sw0yPtNtQSN6mG6M6WP8vxObhDezgUQa
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00080000000234ce-12.dat acprotect -
Deletes itself 1 IoCs
pid Process 1356 rundl132.exe -
Executes dropped EXE 1 IoCs
pid Process 1356 rundl132.exe -
Loads dropped DLL 1 IoCs
pid Process 1356 rundl132.exe -
resource yara_rule behavioral2/memory/3576-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000d000000023424-5.dat upx behavioral2/memory/3576-8-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00080000000234ce-12.dat upx behavioral2/memory/1356-15-0x0000000010000000-0x000000001000D000-memory.dmp upx behavioral2/memory/1356-16-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ykbgc = "C:\\Windows\\rundl13a.exe" 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Rav26.dll rundl132.exe File opened for modification C:\Windows\SysWOW64\Rav26.dll rundl132.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe File opened for modification C:\Windows\rundl132.exe 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe File created C:\Windows\rundl13a.exe 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe File opened for modification C:\Windows\rundl13a.exe 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe 1356 rundl132.exe 1356 rundl132.exe 1356 rundl132.exe 1356 rundl132.exe 1356 rundl132.exe 1356 rundl132.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe Token: SeDebugPrivilege 1356 rundl132.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1356 rundl132.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3576 wrote to memory of 1356 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe 86 PID 3576 wrote to memory of 1356 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe 86 PID 3576 wrote to memory of 1356 3576 3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\rundl132.exeC:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\3a6e80c3c8c123e2b0549e6d6b980dff_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5145f02a4ec8ba91674bab4abf3181ca6
SHA1819f03c5e7fe4361d88c68344ff4fd436044dff7
SHA2562a88b6879830727ce6631908786094f3d1e939c92cf73936ce6c08e0a45c8b02
SHA5123258ec460aeb3cb775e2cfdb481458103da33cc3ffc8af58489908bd360a1ec42f415cca51064bf980c841d85798acd75cabe6e0dcf5dc83c2d3467f34158087
-
Filesize
20KB
MD53a6e80c3c8c123e2b0549e6d6b980dff
SHA1f85bf93e05379c7f43bfcf2eb59a84cc047f0135
SHA256438fc9b1f075a5a3e8bc3ee46ba5b073320199f8d574bac862cf553bdbf82626
SHA512481b5a9e29490324544f0a0defe5930e0e965b5ee1e36cb724d6a0e0949b20754ffa05543aa6a84b2e6a4ed7c992c48d7862aa69b093d2ad0fd9432ee29da808