Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 02:13
Static task
static1
Behavioral task
behavioral1
Sample
7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe
-
Size
33KB
-
MD5
7235a6cb8daf05e126accb0bb71b1745
-
SHA1
79f3234feb1af48fcec3c01c25e6298a1e14483a
-
SHA256
908095ef8efd3243e7233d7f33fe7b78f65a563ca43180a0826e8b6d4cc49ce6
-
SHA512
6840fb7018bfb89af2c26e99c5f65ac3a09cb275b152b23850a8b09a40310d81e19532dadbd16bfb04632611ae64000fdfcd6a12e9bebdf3b4baa41ab0480e52
-
SSDEEP
768:erPCBB3zaPmI9/oHW40OmV+rI1dQG4csxaKVTWbb:QPCBRaPt5oHWfq81dQG4jxaKVTk
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4088 wuaucldt.exe 3208 wuaucldt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\windows\\system32\\wuaucldt.exe" wuaucldt.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\users\\admin\\wuaucldt.exe" wuaucldt.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\wuaucldt.exe 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\wuaucldt.exe wuaucldt.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3208 set thread context of 1560 3208 wuaucldt.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuaucldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuaucldt.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1168 wrote to memory of 4088 1168 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 86 PID 1168 wrote to memory of 4088 1168 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 86 PID 1168 wrote to memory of 4088 1168 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 86 PID 4088 wrote to memory of 3208 4088 wuaucldt.exe 88 PID 4088 wrote to memory of 3208 4088 wuaucldt.exe 88 PID 4088 wrote to memory of 3208 4088 wuaucldt.exe 88 PID 3208 wrote to memory of 1560 3208 wuaucldt.exe 90 PID 3208 wrote to memory of 1560 3208 wuaucldt.exe 90 PID 3208 wrote to memory of 1560 3208 wuaucldt.exe 90 PID 3208 wrote to memory of 1560 3208 wuaucldt.exe 90 PID 3208 wrote to memory of 1560 3208 wuaucldt.exe 90 PID 1168 wrote to memory of 3100 1168 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 91 PID 1168 wrote to memory of 3100 1168 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 91 PID 1168 wrote to memory of 3100 1168 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 91 PID 4088 wrote to memory of 4784 4088 wuaucldt.exe 93 PID 4088 wrote to memory of 4784 4088 wuaucldt.exe 93 PID 4088 wrote to memory of 4784 4088 wuaucldt.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\windows\SysWOW64\wuaucldt.exec:\windows\system32\wuaucldt.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\users\admin\wuaucldt.exec:\users\admin\wuaucldt.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:1560
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\windows\syswow64\wuaucldt.exe3⤵
- System Location Discovery: System Language Discovery
PID:4784
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\users\admin\appdata\local\temp\7235A6~1.EXE2⤵
- System Location Discovery: System Language Discovery
PID:3100
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD57235a6cb8daf05e126accb0bb71b1745
SHA179f3234feb1af48fcec3c01c25e6298a1e14483a
SHA256908095ef8efd3243e7233d7f33fe7b78f65a563ca43180a0826e8b6d4cc49ce6
SHA5126840fb7018bfb89af2c26e99c5f65ac3a09cb275b152b23850a8b09a40310d81e19532dadbd16bfb04632611ae64000fdfcd6a12e9bebdf3b4baa41ab0480e52