Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 22:53
Static task
static1
Behavioral task
behavioral1
Sample
7193a79abe154f04400c017270e31131_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
7193a79abe154f04400c017270e31131_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
7193a79abe154f04400c017270e31131_JaffaCakes118.exe
-
Size
45KB
-
MD5
7193a79abe154f04400c017270e31131
-
SHA1
2ee9d01af688d4df5908a0fed4e575d70b5d5755
-
SHA256
49a85c25c7a3abe68a4de48d79eca4ac1da4bcbb59a158464aef52ef00088fe9
-
SHA512
1d8a23af253cfa6bf78f6b7d38d31ee40bf7c6d5adff733369ab7fbe1d7674abfa523ac2597edee74ad338508a2607879cec908ded236c7cf574835befb4668c
-
SSDEEP
768:X323i/5MqKWo+CBe0dyvumWGpgIZ/jjPFjwUMaJiApGHNb6mBu:Ii/5MtWo+C80UcGpR/jjPpaSiApGtWsu
Malware Config
Signatures
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3532 set thread context of 2576 3532 7193a79abe154f04400c017270e31131_JaffaCakes118.exe 85 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\8dJ1V5.com 7193a79abe154f04400c017270e31131_JaffaCakes118.exe File opened for modification C:\Windows\Fonts\8dJ1V5.com 7193a79abe154f04400c017270e31131_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7193a79abe154f04400c017270e31131_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7193a79abe154f04400c017270e31131_JaffaCakes118.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings 7193a79abe154f04400c017270e31131_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2576 7193a79abe154f04400c017270e31131_JaffaCakes118.exe 2576 7193a79abe154f04400c017270e31131_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3532 wrote to memory of 2576 3532 7193a79abe154f04400c017270e31131_JaffaCakes118.exe 85 PID 3532 wrote to memory of 2576 3532 7193a79abe154f04400c017270e31131_JaffaCakes118.exe 85 PID 3532 wrote to memory of 2576 3532 7193a79abe154f04400c017270e31131_JaffaCakes118.exe 85 PID 3532 wrote to memory of 2576 3532 7193a79abe154f04400c017270e31131_JaffaCakes118.exe 85 PID 3532 wrote to memory of 2576 3532 7193a79abe154f04400c017270e31131_JaffaCakes118.exe 85 PID 3532 wrote to memory of 2576 3532 7193a79abe154f04400c017270e31131_JaffaCakes118.exe 85 PID 3532 wrote to memory of 2576 3532 7193a79abe154f04400c017270e31131_JaffaCakes118.exe 85 PID 3532 wrote to memory of 2576 3532 7193a79abe154f04400c017270e31131_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\7193a79abe154f04400c017270e31131_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7193a79abe154f04400c017270e31131_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\7193a79abe154f04400c017270e31131_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7193a79abe154f04400c017270e31131_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2576
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4792