Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2024, 06:00
Static task
static1
Behavioral task
behavioral1
Sample
4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe
-
Size
784KB
-
MD5
4d148ff55c527caef0d579e289c5e2d3
-
SHA1
63c60f9a08c873477b2dbd9f7afadaf8f623f769
-
SHA256
60ad128b2c3de54ae3d79d4bcdddcdf6ef79b34bbc95c97af0a3a31cf0389c94
-
SHA512
fa23d661116e2fa892507c2dfb95959ccfa2a9a37db18879ddffd4214f7a39047b33bf803b5f2ec7b3d3284c550f491e68638438e66a9b0060a9b0310c061860
-
SSDEEP
12288:GheJUWbgq9RS3ocRXn+B8Jus3gENtkMTabqb:GsWWbgeRS3ocRXk2vwETkMTamb
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InProcServer32 4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InProcServer32\ = "%SystemRoot%\\SysWow64\\UserDataPlatformHelperUtil.dll" 4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InProcServer32\ThreadingModel = "Both" 4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA} 4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ = "CLSID_HtmlDocForParsingSiteUnmarshaller" 4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Implemented Categories 4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Implemented Categories\{00000003-0000-0000-C000-000000000046} 4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1128 4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1128 4d148ff55c527caef0d579e289c5e2d3_JaffaCakes118.exe