Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2024, 09:11
Static task
static1
Behavioral task
behavioral1
Sample
4da8cc4653403024f13295d427d366e6_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4da8cc4653403024f13295d427d366e6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4da8cc4653403024f13295d427d366e6_JaffaCakes118.exe
-
Size
271KB
-
MD5
4da8cc4653403024f13295d427d366e6
-
SHA1
d7aff59b7b1765561aaf2848efd23bc8fc3b920a
-
SHA256
7a6f0b1d7ef020d580ac722515465548c589952ee05a310b7ef834b4f5602c66
-
SHA512
60ee8852289ba5545cdb087b07aa7d462706f168887d392af5a386f0cbcb52fd25de6ce256104eded5312d769ca2ffaa2e4f579244d274e8bfec5ffeceec19b5
-
SSDEEP
6144:q+FNvDu5NMsd+mF9gNMrhsgRx2aHNs8DtD1SpUxu:lFxDAdMmF94KZJ+z
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4588 0be1aa240a4c24e6.exe -
Executes dropped EXE 2 IoCs
pid Process 4588 0be1aa240a4c24e6.exe 1048 0be1aa240a4c24e6.exe -
resource yara_rule behavioral2/memory/1392-1-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-6-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-7-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1392-9-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-11-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-17-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-18-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-19-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-20-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-21-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-22-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-23-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-24-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-25-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-26-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-27-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-28-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-29-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-30-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-31-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-32-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-33-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-34-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-35-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-36-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-37-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-40-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-41-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-42-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-43-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-44-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-45-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4588-46-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1048-47-0x0000000000400000-0x0000000000541000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Health Monitoring Service Pro = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0be1aa240a4c24e6.exe\"" 0be1aa240a4c24e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*System Health Monitoring Service Pro = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0be1aa240a4c24e6.exe\"" 0be1aa240a4c24e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Health Monitoring Service Pro = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0be1aa240a4c24e6.exe\"" 0be1aa240a4c24e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*System Health Monitoring Service Pro = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0be1aa240a4c24e6.exe\"" 0be1aa240a4c24e6.exe -
Program crash 20 IoCs
pid pid_target Process procid_target 4128 1392 WerFault.exe 82 4236 1392 WerFault.exe 82 3004 4588 WerFault.exe 84 2736 1048 WerFault.exe 91 4912 4588 WerFault.exe 84 5024 4588 WerFault.exe 84 4984 4588 WerFault.exe 84 2080 4588 WerFault.exe 84 4964 4588 WerFault.exe 84 4684 4588 WerFault.exe 84 4576 4588 WerFault.exe 84 1724 4588 WerFault.exe 84 1020 4588 WerFault.exe 84 1056 4588 WerFault.exe 84 1456 4588 WerFault.exe 84 4168 4588 WerFault.exe 84 2004 4588 WerFault.exe 84 2148 1048 WerFault.exe 91 1488 4588 WerFault.exe 84 4352 4588 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1392 wrote to memory of 4588 1392 4da8cc4653403024f13295d427d366e6_JaffaCakes118.exe 84 PID 1392 wrote to memory of 4588 1392 4da8cc4653403024f13295d427d366e6_JaffaCakes118.exe 84 PID 1392 wrote to memory of 4588 1392 4da8cc4653403024f13295d427d366e6_JaffaCakes118.exe 84 PID 4588 wrote to memory of 1048 4588 0be1aa240a4c24e6.exe 91 PID 4588 wrote to memory of 1048 4588 0be1aa240a4c24e6.exe 91 PID 4588 wrote to memory of 1048 4588 0be1aa240a4c24e6.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\4da8cc4653403024f13295d427d366e6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4da8cc4653403024f13295d427d366e6_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\0be1aa240a4c24e6.exe:*C:\Users\Admin\AppData\Local\Temp\4da8cc4653403024f13295d427d366e6_JaffaCakes118.exe *2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\0be1aa240a4c24e6.exea ZZZZZZVURRG3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 6164⤵
- Program crash
PID:2736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 6324⤵
- Program crash
PID:2148
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 7123⤵
- Program crash
PID:3004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 8603⤵
- Program crash
PID:4912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 9043⤵
- Program crash
PID:5024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 9043⤵
- Program crash
PID:4984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 8603⤵
- Program crash
PID:2080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 9923⤵
- Program crash
PID:4964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 11003⤵
- Program crash
PID:4684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 9923⤵
- Program crash
PID:4576
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 15403⤵
- Program crash
PID:1724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 15963⤵
- Program crash
PID:1020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 16123⤵
- Program crash
PID:1056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 16003⤵
- Program crash
PID:1456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 16283⤵
- Program crash
PID:4168
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 16443⤵
- Program crash
PID:2004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 8643⤵
- Program crash
PID:1488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 9963⤵
- Program crash
PID:4352
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 6602⤵
- Program crash
PID:4128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 6682⤵
- Program crash
PID:4236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1392 -ip 13921⤵PID:3160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1392 -ip 13921⤵PID:4784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4588 -ip 45881⤵PID:1844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1048 -ip 10481⤵PID:4780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4588 -ip 45881⤵PID:3140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4588 -ip 45881⤵PID:1052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4588 -ip 45881⤵PID:4228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4588 -ip 45881⤵PID:4288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4588 -ip 45881⤵PID:652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4588 -ip 45881⤵PID:1504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4588 -ip 45881⤵PID:3040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4588 -ip 45881⤵PID:692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4588 -ip 45881⤵PID:4036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4588 -ip 45881⤵PID:3224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4588 -ip 45881⤵PID:2800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4588 -ip 45881⤵PID:2240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4588 -ip 45881⤵PID:3748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 1048 -ip 10481⤵PID:416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4588 -ip 45881⤵PID:3952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4588 -ip 45881⤵PID:4736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271KB
MD533c664f344862d494dde4cad1c868095
SHA1ce847491445a665c075f7f7c5308438c150c6b8e
SHA256ed44e96fafb87a676c37f2fb20a46ae67b1efe375b2ba9230f0d14bef8eb2593
SHA5127cee6180e88d18942e4657f1dd8f6341776365e695ea6d5e3e2ac1c5201e09f0d9c69d62616c53a833e16801412d3375cb5b106031e735e3bdb346a925894744