Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 16:42
Static task
static1
Behavioral task
behavioral1
Sample
78d2bfb32b5e11c292cca41bbcea96a1_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
78d2bfb32b5e11c292cca41bbcea96a1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
78d2bfb32b5e11c292cca41bbcea96a1_JaffaCakes118.exe
-
Size
168KB
-
MD5
78d2bfb32b5e11c292cca41bbcea96a1
-
SHA1
877b7039e6064f30f39b526649616ce1b4860dbc
-
SHA256
61a4808d7b62c40af4a1628564565da4ddefe1114ccfe5600f2d81cccfb817a0
-
SHA512
22a42dd54bfc94628b7bb8a378813fc915d46888be7dcac6a1ef57ad3dbc17193bb6c69892cc49afe5567db8803f989fe5344f6858d573f9bf0e0a3d040a9b48
-
SSDEEP
3072:Cx4JqIUIlL7Sgjr9JuB/RVgU974KlGro2UWQRtgxC6c3ovNRdNUirqSmF7Nv5:Cx2qIZL7Sgj7mVJ974KlGM/g46cYVWiK
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "services.exe" a9.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation 78d2bfb32b5e11c292cca41bbcea96a1_JaffaCakes118.exe -
Executes dropped EXE 3 IoCs
pid Process 3220 QvodSetupPlus3.exe 1508 a9.exe 2464 ~24065764.exe -
resource yara_rule behavioral2/files/0x000a000000023476-5.dat upx behavioral2/files/0x00090000000234d3-16.dat upx behavioral2/memory/1508-21-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3220-20-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3220-23-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1508-24-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3220-25-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1508-26-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1508-28-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3220-37-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1508-38-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3220-51-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3220-53-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3220-57-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3220-63-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3220-67-0x0000000000400000-0x0000000000457000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msconfig = "C:\\Windows\\system32\\bDf8D.exe" a9.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\bDf8D.exe a9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78d2bfb32b5e11c292cca41bbcea96a1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QvodSetupPlus3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ~24065764.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 1508 a9.exe 2464 ~24065764.exe 2464 ~24065764.exe 2464 ~24065764.exe 2464 ~24065764.exe 2464 ~24065764.exe 2464 ~24065764.exe 2464 ~24065764.exe 2464 ~24065764.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1508 a9.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3220 QvodSetupPlus3.exe 3220 QvodSetupPlus3.exe 3220 QvodSetupPlus3.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3220 QvodSetupPlus3.exe 3220 QvodSetupPlus3.exe 3220 QvodSetupPlus3.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3372 wrote to memory of 3220 3372 78d2bfb32b5e11c292cca41bbcea96a1_JaffaCakes118.exe 84 PID 3372 wrote to memory of 3220 3372 78d2bfb32b5e11c292cca41bbcea96a1_JaffaCakes118.exe 84 PID 3372 wrote to memory of 3220 3372 78d2bfb32b5e11c292cca41bbcea96a1_JaffaCakes118.exe 84 PID 3372 wrote to memory of 1508 3372 78d2bfb32b5e11c292cca41bbcea96a1_JaffaCakes118.exe 85 PID 3372 wrote to memory of 1508 3372 78d2bfb32b5e11c292cca41bbcea96a1_JaffaCakes118.exe 85 PID 3372 wrote to memory of 1508 3372 78d2bfb32b5e11c292cca41bbcea96a1_JaffaCakes118.exe 85 PID 1508 wrote to memory of 2464 1508 a9.exe 99 PID 1508 wrote to memory of 2464 1508 a9.exe 99 PID 1508 wrote to memory of 2464 1508 a9.exe 99 PID 2464 wrote to memory of 2316 2464 ~24065764.exe 100 PID 2464 wrote to memory of 2316 2464 ~24065764.exe 100 PID 2464 wrote to memory of 2316 2464 ~24065764.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\78d2bfb32b5e11c292cca41bbcea96a1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\78d2bfb32b5e11c292cca41bbcea96a1_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\QvodSetupPlus3.exe"C:\Users\Admin\AppData\Local\Temp\QvodSetupPlus3.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3220
-
-
C:\Users\Admin\AppData\Local\Temp\a9.exe"C:\Users\Admin\AppData\Local\Temp\a9.exe"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\~24065764.exeC:\Users\Admin\AppData\Local\Temp\~24065764.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\cmd.execmd4⤵
- System Location Discovery: System Language Discovery
PID:2316
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149KB
MD5a3de6c880f4fbe1c2fdae63bed2587c5
SHA1d24408ca4349f83b66409e773fab10863469a1f6
SHA256eae20a59c483e08d98b03e9367af8069ae78133240f0ad73077db1f5f63c1e39
SHA512218523a61e1cb2da1e2f92170965bcb51f3dc006365be606cd3d19fe8abe54c6c59674c161febdeacdc0fa8974a5ed1bfe00471c1762184026646cbc9881d12e
-
Filesize
28KB
MD541144d8a173d2ccffbccf51772286c9d
SHA1d260212e0436bd31569c139e6d26f8110158b2a6
SHA256f8b68b8cd71d50c378be5b5fb9f409953410e632692d128f41912e3c687856ee
SHA512144c6471891e5436e08db7f08317b3c15d892d897192dac1e0c8ce5d810b122fa50ae4c6a58bedc5fb05fa6d3bd5f841cef6126e2d0197ee7712e9d00b5dbb57
-
Filesize
8KB
MD516e6771a3844fdfce1552542c6c4cc30
SHA16b6ef255ce43275f79376495b21ca2d4e7cefdb0
SHA256bd1e165cec286256f5fe06a999a41e30ca82c739bd2b5b1e3a6c715adb84a57f
SHA512ac0d9c55f8958dfa15890c0c96342f2c88fd18f07d764208c34dce44d9993dbd6fa9fb5f4e7ab67f801b3220901d41267084e93d6cf8252e43dcac058ce930e4