Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2024, 05:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe
-
Size
127KB
-
MD5
4ce8834e281ba6e2ebb5e8ef46fb4c04
-
SHA1
61ff25addac3ec85579df4bd04ab827394c9fd92
-
SHA256
079df0ff0a7eb5adb5408c3424ab70b99941d831a71811616391a73b50f088ac
-
SHA512
3f4467f24a8abafa4c33b3b15192308071e8d6d03e93ee71eee00d6f017dccca1a76c6ed781256084ec962a1fe11da279f95141dde45c056aa36223373fafcff
-
SSDEEP
3072:u8ihQ4mm2y5eAIEHTbBLN/Ct8splmOOGQSn70:u8QQjmDzbBR6zlp70
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\grgrjj.cfg 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\grgrjj.dll 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe File created C:\Windows\SysWOW64\grgrjj.dll 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe File created C:\Windows\SysWOW64\hjk.dll 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hjk.dll 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe File created C:\Windows\SysWOW64\gjbhr.dll 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gjbhr.dll 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe Token: SeDebugPrivilege 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe Token: SeDebugPrivilege 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe Token: SeDebugPrivilege 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2960 wrote to memory of 3440 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 56 PID 2960 wrote to memory of 3440 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 56 PID 2960 wrote to memory of 2068 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 37 PID 2960 wrote to memory of 2068 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 37 PID 2960 wrote to memory of 1432 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 86 PID 2960 wrote to memory of 1432 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 86 PID 2960 wrote to memory of 1432 2960 4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe 86
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2068
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\4ce8834e281ba6e2ebb5e8ef46fb4c04_JaffaCakes118.exe"3⤵PID:1432
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD59fae903f4381392313bd52c2da8e6f2c
SHA19b42448c4bae660a18c760c21c881d6812d1ac40
SHA2561b6145d6959ac7e04bd405af43a33c726a21ddde7ea160b1930934fb9e670e5d
SHA512a22d136dfbc246fc7dcdc23b082f933a4c13ddd9013df0cccef8c283a9b000a28649886f32647d42c83b8d52c2d4c43d56a0cf70fbbd1267954e497fecf09fa9
-
Filesize
325KB
MD57eca5b056689f4b52604e26c7eef7502
SHA12b2fea0fcd1d0e8640067082442c59fd20a47ef8
SHA2564fed4b99b4d2191aac0b0c3e407cd963a27df9044c1f9b5f4fe47dd5e9e3ac1d
SHA512b22a7002abe8fd9c7942e6ed786ea9574adeab56fcd4b9a6526b95142ab65ee0b8f75ed078a2d58e5320eb0c0b27e2741a15ba31e8a59fdfb6d2cd1bb9aab9e2