Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 09:18
Static task
static1
Behavioral task
behavioral1
Sample
5b532b0a545e3cbee73ac9d12192dbd6_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5b532b0a545e3cbee73ac9d12192dbd6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5b532b0a545e3cbee73ac9d12192dbd6_JaffaCakes118.exe
-
Size
382KB
-
MD5
5b532b0a545e3cbee73ac9d12192dbd6
-
SHA1
020d19ae4625d9f8536a3e9105c4790ab54dfe64
-
SHA256
e6c3370a121b74be33af5c7daf69750fd1eef77f9a668fcb18639e3da808d67c
-
SHA512
7adc7b575fc4bae37bd8d58aa8f8f765adea7dec502d4c2a93b9171b5ae6ee5b2acfee121e4c5d48148559ec23673e12c82da1a39c57cbcb24b8301f9c83d51d
-
SSDEEP
6144:2WaEC2hxAMAhymq6BE8PCaN633aHHc5UykfEOOy+ZXf7UTmmjf/b8NPTZ/5J83:djhKJhDBE263d1kfIZvyjr0ZD83
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4460 Setup.exe 540 yxxsj.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5b532b0a545e3cbee73ac9d12192dbd6_JaffaCakes118.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\yxxsj.exe Setup.exe File created C:\Windows\uninstal.bat Setup.exe File created C:\Windows\yxxsj.exe Setup.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4460 Setup.exe Token: SeDebugPrivilege 540 yxxsj.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 540 yxxsj.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3028 wrote to memory of 4460 3028 5b532b0a545e3cbee73ac9d12192dbd6_JaffaCakes118.exe 84 PID 3028 wrote to memory of 4460 3028 5b532b0a545e3cbee73ac9d12192dbd6_JaffaCakes118.exe 84 PID 3028 wrote to memory of 4460 3028 5b532b0a545e3cbee73ac9d12192dbd6_JaffaCakes118.exe 84 PID 540 wrote to memory of 3512 540 yxxsj.exe 89 PID 540 wrote to memory of 3512 540 yxxsj.exe 89 PID 4460 wrote to memory of 3244 4460 Setup.exe 92 PID 4460 wrote to memory of 3244 4460 Setup.exe 92 PID 4460 wrote to memory of 3244 4460 Setup.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b532b0a545e3cbee73ac9d12192dbd6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5b532b0a545e3cbee73ac9d12192dbd6_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Setup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Setup.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat3⤵PID:3244
-
-
-
C:\Windows\yxxsj.exeC:\Windows\yxxsj.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵PID:3512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
743KB
MD56d426a0b603dfd68be553d6d8b9faa26
SHA16a21b635ead0bd4e83f27e8f20c8eeb64b50966c
SHA2563292745838d07161d7efc23e7139e065eb18ff626d0361dc7a0e54957ff13507
SHA512306634affc21d9270f5c7a803799b658bb114a6e3ac2c4beef6e65cf1771c4e8a4bd13f056ffe92b690b477c15be71453597dbf742e85c9abd8c0327316897c6
-
Filesize
158B
MD55c7ac7be691db8bc6ab3d17f804859d0
SHA1fa1af53cd2c7a7ccbecf3dfa728ddac591ac73a0
SHA256c078e1033ad4d87f6f7399c028410e2785528064086a7147ee067ffce113fcb1
SHA5122e10ee35e3574bacabcdf43f9d50d42ec91eacbb23ab3f39ecd28358eee550ef157ea15fa4e73449a28b2002043030da13239aee325b94ff0d0b4ca42af42f8c