Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 10:03
Static task
static1
Behavioral task
behavioral1
Sample
60084e015cce578bcf6175d3af73bce1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
60084e015cce578bcf6175d3af73bce1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
60084e015cce578bcf6175d3af73bce1_JaffaCakes118.exe
-
Size
34KB
-
MD5
60084e015cce578bcf6175d3af73bce1
-
SHA1
d9619d52bc824fdba539fb54fa8e9e68df0b4cdc
-
SHA256
16e39597e6c12031c4dd92c94dbfd8ee915c815159882f6a849eb3ef96a13d22
-
SHA512
a7db800cb550237ab57e281d784b3006decff8225de239a9287e838f7e2ef74673ae478c6274f679ec31bf4f98c66396e5b08323799b4e929d5735ac4ff6b9f0
-
SSDEEP
768:cflivXrVKpVhKvtxwYHwVFoeAQumucwUQj:ylqrVKprVuQuxj
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation 60084e015cce578bcf6175d3af73bce1_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4056 jusched.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\b02a2eb7\b02a2eb7 60084e015cce578bcf6175d3af73bce1_JaffaCakes118.exe File created C:\Program Files (x86)\b02a2eb7\jusched.exe 60084e015cce578bcf6175d3af73bce1_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe 4056 jusched.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4572 wrote to memory of 4056 4572 60084e015cce578bcf6175d3af73bce1_JaffaCakes118.exe 91 PID 4572 wrote to memory of 4056 4572 60084e015cce578bcf6175d3af73bce1_JaffaCakes118.exe 91 PID 4572 wrote to memory of 4056 4572 60084e015cce578bcf6175d3af73bce1_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\60084e015cce578bcf6175d3af73bce1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\60084e015cce578bcf6175d3af73bce1_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Program Files (x86)\b02a2eb7\jusched.exe"C:\Program Files (x86)\b02a2eb7\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
35KB
MD5fadc8687aa55865a7d61a2c9e6a70a13
SHA14ec57fe87e1274764d0d9bbc8dcc94ed40d306b7
SHA256f1257d5f6d1ca2b3f60f9e2ce9dc2571b588199d363753c64be32920c5a81c88
SHA5120a8f1292b726affe0ccf35d57ad2f0e5913c63132466419398db28305b77cee19e58185736b7c7a6c194227b333c3a59ed10ae3c0bb12e9e31130a882c195215