Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2024, 05:17
Behavioral task
behavioral1
Sample
6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe
-
Size
33KB
-
MD5
6a5dff1402c457fec4ed0846d3bf3427
-
SHA1
1a2e0955badb57a335c819308bf4b094ba492ffd
-
SHA256
c1cd061ed02dd9c82e6fba7423718cb4c71ccae379187e66349ad235d43fc2b1
-
SHA512
985507fc1578dc4f9864b31c2ea5e9ce627b86dabef690269475f5ecf28b6747d760f4a52d7f7bf4d6c425a2419f7f4b21f74f47ebefe97fdc3058efa50021c7
-
SSDEEP
768:MvWzqcMcMkrWn+1f1pc/2Id5uVqwXSNjrFmEE3mX7Ue5:MHcM2rWn+ZQcqwiNjrcEEAIe5
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4360 rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 4360 rundll32.exe -
resource yara_rule behavioral2/memory/2352-0-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral2/memory/2352-13-0x0000000000400000-0x0000000000416000-memory.dmp upx -
Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\yuksuser.dll 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\yuksuser.dll 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe File created C:\Windows\SysWOW64\ksuser.dll 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe File created C:\Windows\SysWOW64\yumidimap.dll 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllcache\midimap.dll 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe File created C:\Windows\SysWOW64\msimg32.dll 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllcache\ksuser.dll 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe File created C:\Windows\SysWOW64\midimap.dll 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe File created C:\Windows\SysWOW64\yumsimg32.dll 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllcache\msimg32.dll 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe File created C:\Windows\SysWOW64\sysapp30.dll 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4932 sc.exe 4144 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2352 wrote to memory of 3496 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 84 PID 2352 wrote to memory of 3496 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 84 PID 2352 wrote to memory of 3496 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 84 PID 2352 wrote to memory of 4932 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 85 PID 2352 wrote to memory of 4932 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 85 PID 2352 wrote to memory of 4932 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 85 PID 2352 wrote to memory of 4144 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 86 PID 2352 wrote to memory of 4144 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 86 PID 2352 wrote to memory of 4144 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 86 PID 2352 wrote to memory of 4360 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 90 PID 2352 wrote to memory of 4360 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 90 PID 2352 wrote to memory of 4360 2352 6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe 90 PID 3496 wrote to memory of 3868 3496 net.exe 91 PID 3496 wrote to memory of 3868 3496 net.exe 91 PID 3496 wrote to memory of 3868 3496 net.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6a5dff1402c457fec4ed0846d3bf3427_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\net.exenet stop cryptsvc2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop cryptsvc3⤵
- System Location Discovery: System Language Discovery
PID:3868
-
-
-
C:\Windows\SysWOW64\sc.exesc config cryptsvc start= disabled2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4932
-
-
C:\Windows\SysWOW64\sc.exesc delete cryptsvc2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4144
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Users\Admin\AppData\Local\Temp\1721798231.dat, ServerMain c:\users\admin\appdata\local\temp\6a5dff1402c457fec4ed0846d3bf3427_jaffacakes118.exe2⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD59d4a5bc50b48c654eed239b1b5a5422f
SHA13272ef5d68e7784590486c1c5994825c4c148193
SHA2565c6bd826eb8cca52e71419740876323d3ddd17f3e4f0b113dbd6da4611a7d125
SHA512aee004b7223f78b5425b4ffd1fd07b64cc923a3f1dbce853da703b7357f79468d70a55922b389dc4234ceddfea3cad250dc2e452d6f76392c4a41f4447c09e04