Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe
-
Size
317KB
-
MD5
4adfdc059136ebf94d5396baf9e91ef5
-
SHA1
e5ee06446f1ffa5720990c1d836f6d10512439ab
-
SHA256
ea5e0925be72cbf6902f0a78494611e2ed4356a8bc03b02a165997a527d60331
-
SHA512
d0b9a236c49674abd2f693951acfa21fff603942ee20efb81c2076d72e9096442aaf1c4043e8a092fd15e2a9199959079e73b55b2343758675afbc733393fb29
-
SSDEEP
6144:davERPh5qe7/JFB7XYdjSYGioU8DmiUtH:dNRP2e7/JFTD1UtH
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2560 gHmBnNi01819.exe -
Executes dropped EXE 1 IoCs
pid Process 2560 gHmBnNi01819.exe -
resource yara_rule behavioral2/memory/664-2-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/664-3-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/664-5-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/2560-19-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/2560-18-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/664-22-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/2560-23-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/2560-34-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/664-41-0x0000000000400000-0x00000000004B4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gHmBnNi01819 = "C:\\ProgramData\\gHmBnNi01819\\gHmBnNi01819.exe" gHmBnNi01819.exe -
Program crash 25 IoCs
pid pid_target Process procid_target 4092 664 WerFault.exe 82 1376 2560 WerFault.exe 86 3880 664 WerFault.exe 82 1296 2560 WerFault.exe 86 3952 664 WerFault.exe 82 3460 2560 WerFault.exe 86 60 664 WerFault.exe 82 1200 2560 WerFault.exe 86 4124 664 WerFault.exe 82 1224 2560 WerFault.exe 86 2464 664 WerFault.exe 82 2992 2560 WerFault.exe 86 4496 664 WerFault.exe 82 4944 2560 WerFault.exe 86 3532 2560 WerFault.exe 86 3496 2560 WerFault.exe 86 4628 2560 WerFault.exe 86 4448 2560 WerFault.exe 86 2096 2560 WerFault.exe 86 3036 2560 WerFault.exe 86 3808 2560 WerFault.exe 86 4488 664 WerFault.exe 82 936 664 WerFault.exe 82 3976 2560 WerFault.exe 86 2300 2560 WerFault.exe 86 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 664 4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe Token: SeDebugPrivilege 2560 gHmBnNi01819.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2560 gHmBnNi01819.exe 2560 gHmBnNi01819.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2560 gHmBnNi01819.exe 2560 gHmBnNi01819.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2560 gHmBnNi01819.exe 2560 gHmBnNi01819.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 664 wrote to memory of 2560 664 4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe 86 PID 664 wrote to memory of 2560 664 4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe 86 PID 664 wrote to memory of 2560 664 4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664 -
C:\ProgramData\gHmBnNi01819\gHmBnNi01819.exe"C:\ProgramData\gHmBnNi01819\gHmBnNi01819.exe" "C:\Users\Admin\AppData\Local\Temp\4adfdc059136ebf94d5396baf9e91ef5_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 7683⤵
- Program crash
PID:1376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 7763⤵
- Program crash
PID:1296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 7763⤵
- Program crash
PID:3460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 8283⤵
- Program crash
PID:1200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 9363⤵
- Program crash
PID:1224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 9923⤵
- Program crash
PID:2992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 9883⤵
- Program crash
PID:4944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 13883⤵
- Program crash
PID:3532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 16003⤵
- Program crash
PID:3496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 9243⤵
- Program crash
PID:4628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 15923⤵
- Program crash
PID:4448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 16323⤵
- Program crash
PID:2096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 17883⤵
- Program crash
PID:3036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 17963⤵
- Program crash
PID:3808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 11203⤵
- Program crash
PID:3976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 7923⤵
- Program crash
PID:2300
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 6242⤵
- Program crash
PID:4092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 7922⤵
- Program crash
PID:3880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 7922⤵
- Program crash
PID:3952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 8442⤵
- Program crash
PID:60
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 8522⤵
- Program crash
PID:4124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 10002⤵
- Program crash
PID:2464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 10362⤵
- Program crash
PID:4496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 6442⤵
- Program crash
PID:4488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1402⤵
- Program crash
PID:936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 664 -ip 6641⤵PID:5024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2560 -ip 25601⤵PID:3920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 664 -ip 6641⤵PID:464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2560 -ip 25601⤵PID:3648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 664 -ip 6641⤵PID:4636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2560 -ip 25601⤵PID:2012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 664 -ip 6641⤵PID:732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2560 -ip 25601⤵PID:740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 664 -ip 6641⤵PID:884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2560 -ip 25601⤵PID:3624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 664 -ip 6641⤵PID:2168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2560 -ip 25601⤵PID:1608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 664 -ip 6641⤵PID:2984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2560 -ip 25601⤵PID:3956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2560 -ip 25601⤵PID:2636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 2560 -ip 25601⤵PID:4704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2560 -ip 25601⤵PID:2556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2560 -ip 25601⤵PID:1720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 2560 -ip 25601⤵PID:4316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 2560 -ip 25601⤵PID:4880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 2560 -ip 25601⤵PID:4940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 664 -ip 6641⤵PID:2708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 664 -ip 6641⤵PID:632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 2560 -ip 25601⤵PID:2544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 2560 -ip 25601⤵PID:1732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
317KB
MD520cbce04c86a31f0f319632eaf431829
SHA11a7db32c6b45ba639994dd49e097d6c764374016
SHA25629737b2a9b1df84b2b2e1929ada791ddc56652efd52e6754e08ecd821145a339
SHA512fb73c26c4e0d6ebd21867df506e99fc9829c8741c29ddd4eef0a4ca8bdc2026074127d3bafd3a489548c065cf31e490ea6bdc26f9e9ee23ef665c749d65a6b90