Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 01:23
Behavioral task
behavioral1
Sample
88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe
-
Size
30KB
-
MD5
88717db803bbd281ef85add676ae4fa3
-
SHA1
55e1102e17cfbc05ea15111ab59a1a7674e1d110
-
SHA256
2cee0c529de216937ee9c1533024d09a86871e6d9b2bccf57b0cee0409ca0257
-
SHA512
c90d03f21d5de0167b4e35dfb3d74db32d15153d6921aa224fa6aa1157cf9f926cf866765691b35eb796164a07968720db98e5a949654f8cb0e32c515087aff0
-
SSDEEP
768:Q4BRQpmyPUalY4hZvrQHiv60uwdkrwWPmv:pRl4hZv4iv69wZW6
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1240 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/1240-0-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral2/memory/1240-4-0x0000000010000000-0x0000000010015000-memory.dmp upx behavioral2/files/0x00090000000233eb-3.dat upx behavioral2/memory/1240-7-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral2/memory/1240-8-0x0000000010000000-0x0000000010015000-memory.dmp upx behavioral2/memory/1240-14-0x0000000000400000-0x0000000000411000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\nnnmjhi.dll 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\nnnmjhi.dll 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1240 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe 1240 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1240 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1240 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1240 wrote to memory of 612 1240 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe 5 PID 1240 wrote to memory of 3224 1240 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe 95 PID 1240 wrote to memory of 3224 1240 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe 95 PID 1240 wrote to memory of 3224 1240 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe 95 PID 1240 wrote to memory of 1692 1240 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe 96 PID 1240 wrote to memory of 1692 1240 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe 96 PID 1240 wrote to memory of 1692 1240 88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe 96
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe ,Activate2⤵
- System Location Discovery: System Language Discovery
PID:3224
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\88717db803bbd281ef85add676ae4fa3_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43B
MD59a7ef09167a6f4433681b94351509043
SHA1259b1375ed8e84943ca1d42646bb416325c89e12
SHA256d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7
SHA51296b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df
-
Filesize
26KB
MD53fb9c472ff08eb22bae1b0a8f913d6d5
SHA11186f3b30f57883ffec0e2bb764763ac25dbe21a
SHA256af7aee7a7d6a5e27d9d0ff7f61274dda54f38ce8733dce4aef63d9480662be8f
SHA512a6a8adec15b707b9de28f0ff2070f81c4acd02ec31a6677a385696991ea83ca6524c352b58e8643884574fddf2bfdaed1fcfa776b7a4e6a9c2792e3ec6bb3c07