Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 23:20
Behavioral task
behavioral1
Sample
71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe
-
Size
219KB
-
MD5
71a9edbe5c47cfc4bb59df22496d9607
-
SHA1
f842dcc17efea3b5a64afa5d1b25b1a56badec45
-
SHA256
0a79711a3553c7c2d54c63071f665faeca77086aae4c742f6d2986a93a31abc5
-
SHA512
1cffed000c75f78d2ddde2f7f1e7b6ebd9a78472dd39ac530dede36e2ac625c757eedfdb0c1cb57e6a1e466c43fa2618d60d18955838d052f1889ed42bcaeaa4
-
SSDEEP
3072:KvcXLx5Bzqcyxx7/gipQ8Ga7ue2PWi8A4zSk:RxbK7/giyZaae2PtgSk
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4396 idemoodp0cetka.exe 1760 idemoodp0cetka.exe -
resource yara_rule behavioral2/memory/1188-0-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/1188-6-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/files/0x0003000000022ab7-11.dat upx behavioral2/memory/4396-22-0x0000000000400000-0x0000000000439000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MS Service Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idemoodp0cetka.exe" 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS Service Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idemoodp0cetka.exe" 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1188 set thread context of 1968 1188 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe 85 PID 4396 set thread context of 1760 4396 idemoodp0cetka.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idemoodp0cetka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idemoodp0cetka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1188 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe 4396 idemoodp0cetka.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1188 wrote to memory of 1968 1188 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe 85 PID 1188 wrote to memory of 1968 1188 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe 85 PID 1188 wrote to memory of 1968 1188 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe 85 PID 1188 wrote to memory of 1968 1188 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe 85 PID 1188 wrote to memory of 1968 1188 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe 85 PID 1188 wrote to memory of 1968 1188 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe 85 PID 1188 wrote to memory of 1968 1188 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe 85 PID 1188 wrote to memory of 1968 1188 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe 85 PID 1968 wrote to memory of 4396 1968 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe 89 PID 1968 wrote to memory of 4396 1968 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe 89 PID 1968 wrote to memory of 4396 1968 71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe 89 PID 4396 wrote to memory of 1760 4396 idemoodp0cetka.exe 90 PID 4396 wrote to memory of 1760 4396 idemoodp0cetka.exe 90 PID 4396 wrote to memory of 1760 4396 idemoodp0cetka.exe 90 PID 4396 wrote to memory of 1760 4396 idemoodp0cetka.exe 90 PID 4396 wrote to memory of 1760 4396 idemoodp0cetka.exe 90 PID 4396 wrote to memory of 1760 4396 idemoodp0cetka.exe 90 PID 4396 wrote to memory of 1760 4396 idemoodp0cetka.exe 90 PID 4396 wrote to memory of 1760 4396 idemoodp0cetka.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\71a9edbe5c47cfc4bb59df22496d9607_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1760
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
219KB
MD571a9edbe5c47cfc4bb59df22496d9607
SHA1f842dcc17efea3b5a64afa5d1b25b1a56badec45
SHA2560a79711a3553c7c2d54c63071f665faeca77086aae4c742f6d2986a93a31abc5
SHA5121cffed000c75f78d2ddde2f7f1e7b6ebd9a78472dd39ac530dede36e2ac625c757eedfdb0c1cb57e6a1e466c43fa2618d60d18955838d052f1889ed42bcaeaa4