Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 04:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe
-
Size
34KB
-
MD5
a12fc4d10baf8f7649491e50d1368daa
-
SHA1
06cc226a24fc79a07c221c2df57f8e4fd877c454
-
SHA256
998a0d585d03a18991efa85d83adc80a4c53a36e906d3966ab5d8a78e92864f4
-
SHA512
9e82982743f4e706eec184cb82afeb3c8f1ebb64554a8efa912dd4717907985cad6db77748beca7f6724d9d007a1233ca5f66b5af1382f2562ec1fc5009f01c6
-
SSDEEP
768:V7Gz+yNI6jAM0kDyPUcEe/dj7CeabWtP6j+AOOJb5kOce:V7GqyNI6jFusNo1CvWF6jo0uOZ
Score
6/10
Malware Config
Signatures
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ip.ini a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe File created C:\Windows\SysWOW64\ip2.ini a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4840 wrote to memory of 748 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 87 PID 4840 wrote to memory of 748 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 87 PID 4840 wrote to memory of 748 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 87 PID 4840 wrote to memory of 1804 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 88 PID 4840 wrote to memory of 1804 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 88 PID 4840 wrote to memory of 1804 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 88 PID 4840 wrote to memory of 4780 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 89 PID 4840 wrote to memory of 4780 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 89 PID 4840 wrote to memory of 4780 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 89 PID 4840 wrote to memory of 2520 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 90 PID 4840 wrote to memory of 2520 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 90 PID 4840 wrote to memory of 2520 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 90 PID 4840 wrote to memory of 3048 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 91 PID 4840 wrote to memory of 3048 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 91 PID 4840 wrote to memory of 3048 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 91 PID 4840 wrote to memory of 1276 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 92 PID 4840 wrote to memory of 1276 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 92 PID 4840 wrote to memory of 1276 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 92 PID 4840 wrote to memory of 1748 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 93 PID 4840 wrote to memory of 1748 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 93 PID 4840 wrote to memory of 1748 4840 a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a12fc4d10baf8f7649491e50d1368daa_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /s /q c:*.gho2⤵
- System Location Discovery: System Language Discovery
PID:748
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /s /q d:*.gho2⤵
- System Location Discovery: System Language Discovery
PID:1804
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /s /q e:*.gho2⤵
- System Location Discovery: System Language Discovery
PID:4780
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /s /q f:*.gho2⤵
- System Location Discovery: System Language Discovery
PID:2520
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /s /q g:*.gho2⤵
- System Location Discovery: System Language Discovery
PID:3048
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /s /q h:*.gho2⤵
- System Location Discovery: System Language Discovery
PID:1276
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /s /q i:*.gho2⤵
- System Location Discovery: System Language Discovery
PID:1748
-