Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/08/2024, 21:08
Static task
static1
Behavioral task
behavioral1
Sample
94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe
-
Size
139KB
-
MD5
94bda1bbecf8314ccb0b7cac3bda7217
-
SHA1
d093a5ebf9d5c5f04d19e35d8a2f79bb1ea8f12e
-
SHA256
42028110d6e1320e031446bbdc585acb94a0c0147875a9dfc14c52f85792d5d9
-
SHA512
33c47d6f9aa7708586e7afe8e9ddf10a3db701100e120cae57184cd665c9afc961182fa914fae36db2404b85afafe4542383f90e0acc94b2c76294628efda48f
-
SSDEEP
3072:IVpbSWgMqqDa/QdMm97LHmfQJMtPVFS933s4tEtNiUe2jzWfg:kuIqqDGQd9/HmW6OgNiUBjCfg
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
resource yara_rule behavioral2/memory/3584-0-0x0000000000400000-0x000000000041C000-memory.dmp family_gh0strat behavioral2/memory/3584-3-0x0000000000400000-0x000000000041C000-memory.dmp family_gh0strat behavioral2/memory/3584-4-0x0000000000400000-0x000000000041C000-memory.dmp family_gh0strat behavioral2/files/0x000800000002362d-8.dat family_gh0strat -
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Drivers\beep.sys 94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Drivers\beep.sys svchost.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll" 94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 944 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 3584 94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe 944 svchost.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll 94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2956 set thread context of 3584 2956 94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe 91 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2956 wrote to memory of 3584 2956 94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe 91 PID 2956 wrote to memory of 3584 2956 94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe 91 PID 2956 wrote to memory of 3584 2956 94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe 91 PID 2956 wrote to memory of 3584 2956 94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe 91 PID 2956 wrote to memory of 3584 2956 94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118.exe"2⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3584
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:944
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4404,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:81⤵PID:2604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5b4126f88ff4ac9e728eb23460dfb349e
SHA136088a3582d334c38704368081c2cd5e9e297a52
SHA2563e0e3ec421c902866abd2bc59448e909b7ade329b262b27d70a7687e433cebd8
SHA512cee41e7143e522c94d6c7a9e242340ef25d6b72c0f9ffcde0aabcd10c642838fbb923237ee4b51fcefedae57b3bf93e1b245b910303090c540394ced448e0646
-
Filesize
84B
MD5e91e79c55f83e00281700c888021a2af
SHA1fa3946160a019fbad5aabc1a5baff95c03dbf598
SHA25653bb164c3495656efeb333105323326552ed82f382ca85261c1b4d62afc66e78
SHA5126c5bb9153b8a75185262cf89667d6521e284c62b8f2e94e1a188679ad936f6a78c811a3352755397a062d9311803e247ff19fc86c35884e43d44e8aaffc54800