Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 14:20 UTC
Static task
static1
Behavioral task
behavioral1
Sample
746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
-
Size
60KB
-
MD5
746b9e5155240a98d1d748a9a9eae25b
-
SHA1
7da112336eb3540b769d467bbddbce1ccba316c3
-
SHA256
e5789d70cecc0a47d8fe57db9afa3c6425dc2765ef69529f4474200394934e5e
-
SHA512
aeddbca251aaa7ad1359c3d282461c5b7eb1de69773c53e34a27d5f004d58ee77dce23fbf35c35680815063bfaf89745edfa7849613d02e889165a771fe79884
-
SSDEEP
1536:BU8Cnt9E7sSLOi69qFoc3OBWzr48A+d5CPr/50GmbQnCzw4/XliV:G8cTn+dYWzr48ndUj50GkQCzXfU
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Drivers\CelInDriver.sys 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\CelInDrv\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\CelInDriver.sys" 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\xpdhcp.dll 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xpdhcp.dll 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe Token: SeDebugPrivilege 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe Token: SeDebugPrivilege 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 3468 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe 56 PID 2364 wrote to memory of 2548 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe 84 PID 2364 wrote to memory of 2548 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe 84 PID 2364 wrote to memory of 2548 2364 746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe 84
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe"2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe3⤵
- System Location Discovery: System Language Discovery
PID:2548
-
-
Network
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request19.177.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
Remote address:8.8.8.8:53Request58.99.105.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.27.10ax-0001.ax-msedge.netIN A150.171.28.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360264546_1VIJ7TSH89LPKUMDM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239360264546_1VIJ7TSH89LPKUMDM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 675736
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A5383083EFB04739A662AF42167B4DA9 Ref B: LON04EDGE1012 Ref C: 2024-07-26T16:11:52Z
date: Fri, 26 Jul 2024 16:11:51 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301242_1SRW05UUR0YI3F1X9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239317301242_1SRW05UUR0YI3F1X9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 399396
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8881C58AD24C447E8D47BFB62D760DA0 Ref B: LON04EDGE1012 Ref C: 2024-07-26T16:11:52Z
date: Fri, 26 Jul 2024 16:11:51 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301651_1F1H60KU4IQQHGWIG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239317301651_1F1H60KU4IQQHGWIG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 437121
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1ACD405DC3C04DE58084495BF428F223 Ref B: LON04EDGE1012 Ref C: 2024-07-26T16:11:52Z
date: Fri, 26 Jul 2024 16:11:51 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360264545_1QMDV0ZFDT4MYHVM6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239360264545_1QMDV0ZFDT4MYHVM6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 845518
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B5801BA85C8D47D4843716B6A9D4EE9A Ref B: LON04EDGE1012 Ref C: 2024-07-26T16:11:52Z
date: Fri, 26 Jul 2024 16:11:51 GMT
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
150.171.27.10:443https://tse1.mm.bing.net/th?id=OADD2.10239360264545_1QMDV0ZFDT4MYHVM6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90tls, http286.5kB 2.4MB 1796 1792
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360264546_1VIJ7TSH89LPKUMDM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301242_1SRW05UUR0YI3F1X9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301651_1F1H60KU4IQQHGWIG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360264545_1QMDV0ZFDT4MYHVM6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200 -
1.2kB 6.9kB 15 13
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.177.190.20.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
0.205.248.87.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
58.99.105.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
88.156.103.20.in-addr.arpa
-
62 B 170 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
150.171.27.10150.171.28.10
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD50d4d79cd43ea8aa3446c31145391e210
SHA17cdfebf7cce7375b872b3facc24a8ffb8378a58d
SHA256cd5d40c5aba67d6e3326efe4a96d03d1d32097b516db1cfeadabed1fcbfe5006
SHA51232328a89e9b37b6153a68006e2d6573a1d4d48d5c055d0f1a8f9547208ea42b74a33b1ebc792ac17d99a88f5fe57988e1b93176d1721f708f4ab44f39b32c95d