Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 13:04
Static task
static1
Behavioral task
behavioral1
Sample
6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe
-
Size
221KB
-
MD5
6fb089ddae3eaeca1f4e505a80c0bc89
-
SHA1
0880e476574448e6b10e385fbbcbe536cfafabfd
-
SHA256
d0c111ef281e91a0ff27cc1ef0568b3bf2acd4094fd36c88df29ca5672266526
-
SHA512
62f62dd14ae7e10790374e46e84f9b6b35d7dd38766b174dec39686773f7391018c7b14a7643b80282a2bfe01bcaaee23b60413cf1588f2ea6dabfb6c61118d6
-
SSDEEP
1536:7IdcFLZp0dsrYgdRAgH0/m38wIJVOy2JDVhCK8PTSuBlXMfayRg:7IdcFLEdskgrt05bnwhVh6PTPlcfa
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3928 idemoodp0cetka.exe 4084 idemoodp0cetka.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MS Service Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idemoodp0cetka.exe" 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS Service Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idemoodp0cetka.exe" 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4048 set thread context of 1328 4048 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 85 PID 3928 set thread context of 4084 3928 idemoodp0cetka.exe 91 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idemoodp0cetka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idemoodp0cetka.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4048 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 3928 idemoodp0cetka.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4048 wrote to memory of 1328 4048 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 85 PID 4048 wrote to memory of 1328 4048 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 85 PID 4048 wrote to memory of 1328 4048 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 85 PID 4048 wrote to memory of 1328 4048 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 85 PID 4048 wrote to memory of 1328 4048 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 85 PID 4048 wrote to memory of 1328 4048 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 85 PID 4048 wrote to memory of 1328 4048 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 85 PID 4048 wrote to memory of 1328 4048 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 85 PID 1328 wrote to memory of 3928 1328 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 90 PID 1328 wrote to memory of 3928 1328 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 90 PID 1328 wrote to memory of 3928 1328 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 90 PID 3928 wrote to memory of 4084 3928 idemoodp0cetka.exe 91 PID 3928 wrote to memory of 4084 3928 idemoodp0cetka.exe 91 PID 3928 wrote to memory of 4084 3928 idemoodp0cetka.exe 91 PID 3928 wrote to memory of 4084 3928 idemoodp0cetka.exe 91 PID 3928 wrote to memory of 4084 3928 idemoodp0cetka.exe 91 PID 3928 wrote to memory of 4084 3928 idemoodp0cetka.exe 91 PID 3928 wrote to memory of 4084 3928 idemoodp0cetka.exe 91 PID 3928 wrote to memory of 4084 3928 idemoodp0cetka.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4084
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221KB
MD56fb089ddae3eaeca1f4e505a80c0bc89
SHA10880e476574448e6b10e385fbbcbe536cfafabfd
SHA256d0c111ef281e91a0ff27cc1ef0568b3bf2acd4094fd36c88df29ca5672266526
SHA51262f62dd14ae7e10790374e46e84f9b6b35d7dd38766b174dec39686773f7391018c7b14a7643b80282a2bfe01bcaaee23b60413cf1588f2ea6dabfb6c61118d6