Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 20:01
Static task
static1
Behavioral task
behavioral1
Sample
68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe
-
Size
215KB
-
MD5
68b824adf3d751b86a60303946afbd07
-
SHA1
1c434c641cb46939c084e2f6cb29fdb6869c5c74
-
SHA256
cf9821fd84d57ee51c4b5faabc170d34b121f37dcd2b0b41737e4209b364c79d
-
SHA512
3c2323d5f1a08ede3763ebac7030e00c599b98d9ebc32aafa086708f5f2fee54bbcedd9dbd94229bdbab0a8e8a08a3cec51e11aabb531731fb121196c1cc3e15
-
SSDEEP
3072:ABmTdhovoxMp/wdri3D7qT04DaGYK+yKEnJpgJnNk7HtG/3m/R7S1cUXsEo1IvB3:arAxA3gd5JpeDvfx/qfz
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smrsc = "C:\\WINDOWS\\system\\smrsc.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\smrsc = "C:\\WINDOWS\\system\\smrsc.exe" reg.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\system\smrsc.exe 68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe File opened for modification C:\Windows\system\smrsc.exe 68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4936 wrote to memory of 3000 4936 68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe 86 PID 4936 wrote to memory of 3000 4936 68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe 86 PID 4936 wrote to memory of 3000 4936 68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe 86 PID 4936 wrote to memory of 4948 4936 68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe 87 PID 4936 wrote to memory of 4948 4936 68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe 87 PID 4936 wrote to memory of 4948 4936 68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe 87 PID 3000 wrote to memory of 1100 3000 cmd.exe 90 PID 3000 wrote to memory of 1100 3000 cmd.exe 90 PID 3000 wrote to memory of 1100 3000 cmd.exe 90 PID 4948 wrote to memory of 1288 4948 cmd.exe 91 PID 4948 wrote to memory of 1288 4948 cmd.exe 91 PID 4948 wrote to memory of 1288 4948 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v smrsc /t REG_SZ /d C:\WINDOWS\system\smrsc.exe /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v smrsc /t REG_SZ /d C:\WINDOWS\system\smrsc.exe /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1100
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices /v smrsc /t REG_SZ /d C:\WINDOWS\system\smrsc.exe /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices /v smrsc /t REG_SZ /d C:\WINDOWS\system\smrsc.exe /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1288
-
-