Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 11:32
Static task
static1
Behavioral task
behavioral1
Sample
5bc3bb8d6908928e7d8ef59ad02323f7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5bc3bb8d6908928e7d8ef59ad02323f7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5bc3bb8d6908928e7d8ef59ad02323f7_JaffaCakes118.exe
-
Size
392KB
-
MD5
5bc3bb8d6908928e7d8ef59ad02323f7
-
SHA1
dd2f97e8c59c857462ae9580871eaa634466bfdf
-
SHA256
9d6ee33c1c4475f02b691d9ed6793690545b68c4b09dc14b837dd6770e8d1217
-
SHA512
e4a875a3a0c14397c767c1c2afd4a124362a72e37a9a99c73e3253e0facbfabfd645a79302546c67808e7afd1bfdc3ebe220f8edd855660a01c62a75fc13dfff
-
SSDEEP
12288:ub8dYKAfakTHEPkqx0pLwG07bLKdosmpRF:ub8dCykDEPkz8G26e
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4232 NB_SER~1.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5bc3bb8d6908928e7d8ef59ad02323f7_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2752 4232 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4424 wrote to memory of 4232 4424 5bc3bb8d6908928e7d8ef59ad02323f7_JaffaCakes118.exe 84 PID 4424 wrote to memory of 4232 4424 5bc3bb8d6908928e7d8ef59ad02323f7_JaffaCakes118.exe 84 PID 4424 wrote to memory of 4232 4424 5bc3bb8d6908928e7d8ef59ad02323f7_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bc3bb8d6908928e7d8ef59ad02323f7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5bc3bb8d6908928e7d8ef59ad02323f7_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NB_SER~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NB_SER~1.EXE2⤵
- Executes dropped EXE
PID:4232 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 2243⤵
- Program crash
PID:2752
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4232 -ip 42321⤵PID:3068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD58033770c5f8e3f15b49636ccbd329d76
SHA1bc8e273d2c5a92c8ea857d3b5b49f9e45ae4f060
SHA256602bb478b3d147d9e44ac89fab651885cbb1002bb55c6b1dd5b21e78ea3cea36
SHA51216dd97a356a48e9a3fb4129046f3e08c2c2b49143ec9e69289abe1168098ae777f81a66e3b06b621eda8c59e4205b449e419f5a1441e064d6613d9b59580ee33