Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 06:38
Static task
static1
Behavioral task
behavioral1
Sample
72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe
-
Size
252KB
-
MD5
72f5de21bef8e2caaf636074c3e72720
-
SHA1
bae0d8fb563355fbdc818f9d0f789ee10219e584
-
SHA256
706472cbbdef4466daeb26f516ae07c24579394e039766f93bf7ab1bfe116e08
-
SHA512
78045460e5d537d600f937fde73f9685578cf0dd087a86cf61127f19e24737b6054226d162e4eeb54eaa6fd23956c40ad2042de98bf71ac56b360d0be3c9d75e
-
SSDEEP
6144:LW57hEh0jrC9DzzsDeEssXPBQA6Onn42VW0dkm4o:L47scokPPBQnOn4j0km4o
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation N0ise.exe -
Executes dropped EXE 3 IoCs
pid Process 2480 N0ise.exe 2688 audiohd.exe 4068 WUDHost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Audio Driver = "\"C:\\Users\\Admin\\AppData\\Roaming\\audiohd.exe\"" N0ise.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows-Network Component = "\"C:\\Windows\\system32\\WUDHost.exe\"" N0ise.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\WUDHost.exe N0ise.exe File opened for modification C:\Windows\system32\WUDHost.exe N0ise.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 N0ise.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier N0ise.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 audiohd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier audiohd.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WUDHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WUDHost.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2480 N0ise.exe 2480 N0ise.exe 2480 N0ise.exe 2480 N0ise.exe 2480 N0ise.exe 2480 N0ise.exe 2480 N0ise.exe 2480 N0ise.exe 2688 audiohd.exe 2688 audiohd.exe 2688 audiohd.exe 2688 audiohd.exe 2688 audiohd.exe 2688 audiohd.exe 2688 audiohd.exe 2688 audiohd.exe 4068 WUDHost.exe 4068 WUDHost.exe 4068 WUDHost.exe 4068 WUDHost.exe 4068 WUDHost.exe 4068 WUDHost.exe 4068 WUDHost.exe 4068 WUDHost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2480 N0ise.exe Token: SeDebugPrivilege 2688 audiohd.exe Token: SeDebugPrivilege 4068 WUDHost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3572 wrote to memory of 2480 3572 72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe 84 PID 3572 wrote to memory of 2480 3572 72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe 84 PID 2480 wrote to memory of 2688 2480 N0ise.exe 89 PID 2480 wrote to memory of 2688 2480 N0ise.exe 89 PID 2480 wrote to memory of 4068 2480 N0ise.exe 90 PID 2480 wrote to memory of 4068 2480 N0ise.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\N0ise.exe"C:\Users\Admin\AppData\Local\Temp\N0ise.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Roaming\audiohd.exe"C:\Users\Admin\AppData\Roaming\audiohd.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\system32\WUDHost.exe"C:\Windows\system32\WUDHost.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4068
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD5289e05dd750815644e1584a823bdd812
SHA1eeca3545db3a0d884f216661044fd9db915690d1
SHA2567bb7ef8e0ea623a83d5d3dd952b56b7dc04dbfca03bad6eba62afe09fbeb0552
SHA512e6fb5d7b347337b3f1a1094b2dd8256c699d3a4f4fa38557e2857f5b2e10e4ee24232e79bad71a6d6c8ce2ff670e4c2bb55815757f499c27b023bfab8ec5f3d3