Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2024, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe
-
Size
205KB
-
MD5
4ccef3620ed4885353203d5d5206689c
-
SHA1
f97e56b04c378cd58d0ca4b56fa8e25027332bd4
-
SHA256
069c33d898fce1026f6eef24ec7a6e3367f16947662d72409d9bf07a9e16fb7e
-
SHA512
9a30ac500dc0369070a32b1ecef2eaa5f652aa2b232fc20dc09a0f4ecb535e912cc8d10a02cf076ae182049ba43385e22dfc9c958129c3871313722871afc801
-
SSDEEP
3072:iikEs0ttGAtZI24Okk8x3zAGPd+o6eZvHmylc+vuXfA2x:/TTGh2Z8xPPdj6Ujc+vIx
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\0QEPP3C1HT6SN = "C:\\Users\\Admin\\AppData\\Roaming\\X7UMG6B9THJH.exe" 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\0QEPP3C1HT6SN = "C:\\Users\\Admin\\AppData\\Roaming\\X7UMG6B9THJH.exe" 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/1976-1-0x0000000000400000-0x0000000000552000-memory.dmp upx behavioral2/memory/1976-4-0x0000000000400000-0x0000000000552000-memory.dmp upx behavioral2/memory/1976-5-0x0000000000400000-0x0000000000552000-memory.dmp upx behavioral2/memory/1976-15-0x0000000000400000-0x0000000000552000-memory.dmp upx behavioral2/memory/1976-35-0x0000000000400000-0x0000000000552000-memory.dmp upx behavioral2/memory/1976-54-0x0000000000400000-0x0000000000552000-memory.dmp upx behavioral2/memory/1976-95-0x0000000000400000-0x0000000000552000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0QEPP3C1HT6SN = "C:\\Users\\Admin\\AppData\\Roaming\\X7UMG6B9THJH.exe" 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0QEPP3C1HT6SN = "C:\\Users\\Admin\\AppData\\Roaming\\X7UMG6B9THJH.exe" 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3456 set thread context of 1976 3456 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1976 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1976 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1976 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe 1976 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3456 wrote to memory of 1976 3456 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe 86 PID 3456 wrote to memory of 1976 3456 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe 86 PID 3456 wrote to memory of 1976 3456 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe 86 PID 3456 wrote to memory of 1976 3456 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe 86 PID 3456 wrote to memory of 1976 3456 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe 86 PID 3456 wrote to memory of 1976 3456 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe 86 PID 3456 wrote to memory of 1976 3456 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe 86 PID 3456 wrote to memory of 1356 3456 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe 87 PID 3456 wrote to memory of 1356 3456 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe 87 PID 3456 wrote to memory of 1356 3456 4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\4ccef3620ed4885353203d5d5206689c_JaffaCakes118.exe2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1976
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RTDATA01.BAT" "2⤵
- Enumerates connected drives
PID:1356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
339B
MD513909be7e6561ea13add97e338010a8a
SHA1f3709c12b905ba6eb7f8d4809eefe873f9d62b3c
SHA256e337c090e33943d64a40baa3aabe610371b7c993c3a81c911e44e9346e96542f
SHA5128a7e7672d70d838da78901184b0ab8d5e2ce0bef3144339df55b14b176a54453e61ea32b6e7f8fcb31bc4f863c06715816663be43b88b5dfa7ede1fcf84fbd73
-
Filesize
205KB
MD54ccef3620ed4885353203d5d5206689c
SHA1f97e56b04c378cd58d0ca4b56fa8e25027332bd4
SHA256069c33d898fce1026f6eef24ec7a6e3367f16947662d72409d9bf07a9e16fb7e
SHA5129a30ac500dc0369070a32b1ecef2eaa5f652aa2b232fc20dc09a0f4ecb535e912cc8d10a02cf076ae182049ba43385e22dfc9c958129c3871313722871afc801