Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 16:01
Static task
static1
Behavioral task
behavioral1
Sample
4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe
-
Size
244KB
-
MD5
4a61d7259e5bc8039c885617f330c832
-
SHA1
58f31adb13aa0509a48cf371268791971dfbe270
-
SHA256
616a50e518ea9e108b8f2c9811ac33119cb1f0c6a0f1de3df5cb2cf66e4c24fc
-
SHA512
36a9048283c03ddae502585660ce6b2b9a450c9f32fcc49a5f1a18c1c5b6623089172467ae61b1b7adfcbe02a919bb99ad67e643fe9ca67031a290544185b33f
-
SSDEEP
6144:oHsUV65Id2L0wHcIwXhv+EhlK7Q5qux9BJiRS:cBV6asQw8ph2EhlPZ9qS
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\npf.sys 4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe -
Loads dropped DLL 3 IoCs
pid Process 1444 4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe 1444 4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe 1444 4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/1444-4-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/1444-7-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/1444-15-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/1444-5-0x0000000000400000-0x000000000049A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sniffer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe" 4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Packet.dll 4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe File created C:\Windows\SysWOW64\wpcap.dll 4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1116 1444 WerFault.exe 82 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1444 4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe 1444 4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 3162⤵
- Program crash
PID:1116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1444 -ip 14441⤵PID:4172
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD5b4d3cbc053e70143d350d6107b94952c
SHA15ebdb0ef1f00a1024637adf106d7b2a9b43bbcda
SHA2562198fd8cd738d6281c8c1fc4845effd251b3d6b7f83b9f4f927d6430cf12537b
SHA512539244352ffc0ca6e08bba2704abd1286873375dad28421862bd9ce7a8146d9472dc5e4ac3edb59ae741f5b178cd22f976fbba62a0bc71c09160e1c9f178e523
-
Filesize
274KB
MD5dae5f233818083af69e2e5133a50a2cb
SHA118a2672972a9440f51b3d416a933b20b8ae6252a
SHA256b0ce20a14e8cef5a94e2ef057e5685eac3636c6b71166b4f99af31c3422c4121
SHA512ca71f6b0c2c1f5c00eda9af97b4426c9ca386785c5f0d712dc971ddf0b13e1a0e7ef691932b61c5fda009df2da8422df09ffaf5061aa0b674a98dcc57caa405a