Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 16:22
Static task
static1
Behavioral task
behavioral1
Sample
a34238e589a5ffcc565d5b8ada3b6f3f_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
a34238e589a5ffcc565d5b8ada3b6f3f_JaffaCakes118.exe
-
Size
96KB
-
MD5
a34238e589a5ffcc565d5b8ada3b6f3f
-
SHA1
0f0d670beff846bf81221540ad5bdf7ea172b289
-
SHA256
1d984bdac19d032f40d585af52ec06b4a43404ee09062c7c48748fa257062681
-
SHA512
7d8d955c658966de4d8760cfb2d3341c398f14806a729be715268a5a6039bfd22460321e0b687324ff32c6d3f19e441d304c050378874c7530aa2e83ac965348
-
SSDEEP
1536:pfFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8pr5XW29c+:pJS4jHS8q/3nTzePCwNUh4E9Akc+
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
resource yara_rule behavioral2/files/0x00090000000234b4-14.dat family_gh0strat behavioral2/memory/4276-16-0x0000000000400000-0x000000000044E240-memory.dmp family_gh0strat behavioral2/memory/3424-19-0x0000000020000000-0x0000000020027000-memory.dmp family_gh0strat behavioral2/memory/2732-24-0x0000000020000000-0x0000000020027000-memory.dmp family_gh0strat behavioral2/memory/1812-29-0x0000000020000000-0x0000000020027000-memory.dmp family_gh0strat -
Deletes itself 1 IoCs
pid Process 4276 jorcsjcinh -
Executes dropped EXE 1 IoCs
pid Process 4276 jorcsjcinh -
Loads dropped DLL 3 IoCs
pid Process 3424 svchost.exe 2732 svchost.exe 1812 svchost.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\vpnudgyvst svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.exe.txt svchost.exe File created C:\Windows\SysWOW64\vxcnljctfp svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.exe.txt svchost.exe File created C:\Windows\SysWOW64\vgqgtmeqsk svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.exe.txt svchost.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 3212 3424 WerFault.exe 93 4484 2732 WerFault.exe 98 1480 1812 WerFault.exe 101 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a34238e589a5ffcc565d5b8ada3b6f3f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jorcsjcinh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4276 jorcsjcinh 4276 jorcsjcinh -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeRestorePrivilege 4276 jorcsjcinh Token: SeBackupPrivilege 4276 jorcsjcinh Token: SeBackupPrivilege 4276 jorcsjcinh Token: SeRestorePrivilege 4276 jorcsjcinh Token: SeBackupPrivilege 3424 svchost.exe Token: SeRestorePrivilege 3424 svchost.exe Token: SeBackupPrivilege 3424 svchost.exe Token: SeBackupPrivilege 3424 svchost.exe Token: SeSecurityPrivilege 3424 svchost.exe Token: SeSecurityPrivilege 3424 svchost.exe Token: SeBackupPrivilege 3424 svchost.exe Token: SeBackupPrivilege 3424 svchost.exe Token: SeSecurityPrivilege 3424 svchost.exe Token: SeBackupPrivilege 3424 svchost.exe Token: SeBackupPrivilege 3424 svchost.exe Token: SeSecurityPrivilege 3424 svchost.exe Token: SeBackupPrivilege 3424 svchost.exe Token: SeRestorePrivilege 3424 svchost.exe Token: SeBackupPrivilege 2732 svchost.exe Token: SeRestorePrivilege 2732 svchost.exe Token: SeBackupPrivilege 2732 svchost.exe Token: SeBackupPrivilege 2732 svchost.exe Token: SeSecurityPrivilege 2732 svchost.exe Token: SeSecurityPrivilege 2732 svchost.exe Token: SeBackupPrivilege 2732 svchost.exe Token: SeBackupPrivilege 2732 svchost.exe Token: SeSecurityPrivilege 2732 svchost.exe Token: SeBackupPrivilege 2732 svchost.exe Token: SeBackupPrivilege 2732 svchost.exe Token: SeSecurityPrivilege 2732 svchost.exe Token: SeBackupPrivilege 2732 svchost.exe Token: SeRestorePrivilege 2732 svchost.exe Token: SeBackupPrivilege 1812 svchost.exe Token: SeRestorePrivilege 1812 svchost.exe Token: SeBackupPrivilege 1812 svchost.exe Token: SeBackupPrivilege 1812 svchost.exe Token: SeSecurityPrivilege 1812 svchost.exe Token: SeSecurityPrivilege 1812 svchost.exe Token: SeBackupPrivilege 1812 svchost.exe Token: SeBackupPrivilege 1812 svchost.exe Token: SeSecurityPrivilege 1812 svchost.exe Token: SeBackupPrivilege 1812 svchost.exe Token: SeBackupPrivilege 1812 svchost.exe Token: SeSecurityPrivilege 1812 svchost.exe Token: SeBackupPrivilege 1812 svchost.exe Token: SeRestorePrivilege 1812 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4088 wrote to memory of 4276 4088 a34238e589a5ffcc565d5b8ada3b6f3f_JaffaCakes118.exe 88 PID 4088 wrote to memory of 4276 4088 a34238e589a5ffcc565d5b8ada3b6f3f_JaffaCakes118.exe 88 PID 4088 wrote to memory of 4276 4088 a34238e589a5ffcc565d5b8ada3b6f3f_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a34238e589a5ffcc565d5b8ada3b6f3f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a34238e589a5ffcc565d5b8ada3b6f3f_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\users\admin\appdata\local\jorcsjcinh"C:\Users\Admin\AppData\Local\Temp\a34238e589a5ffcc565d5b8ada3b6f3f_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\a34238e589a5ffcc565d5b8ada3b6f3f_jaffacakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 8282⤵
- Program crash
PID:3212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3424 -ip 34241⤵PID:2560
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2732 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 8802⤵
- Program crash
PID:4484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2732 -ip 27321⤵PID:3504
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 8962⤵
- Program crash
PID:1480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1812 -ip 18121⤵PID:1644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24.6MB
MD54a9d398987d126671f94d2adbd373894
SHA1954acbfe230365f49f7836b2260486463644cb26
SHA256a1d4b633b1851c7b98b7b108efd75a7568b8770fa0c2dd8fce7eed3e559f02b9
SHA512616e2114ecb5f75b3383af95dec7856198f4bcb947446e0f97e381ca4d2b173fb409889de32fc7cd1b130fa6ce0d7ac937c210ff96871612238907b8bc457ae7
-
Filesize
204B
MD57a90ef7ef4dd5ba0887e2bab82dee0d0
SHA1f0544df09a6c492b5a37b513fde6621ec585ddf5
SHA256b83283ebd9a2acb65c2648966853091db1a638025258918a705d5fb729433635
SHA51213c30b1cd4c5eaedceab0133590af1bce1fea0956682b9a3428a675126d3243b7fccc2eb8d89f57ba7961d0a7e51ef1daaa0da512d1717dc6d9fcfd8130bcdda
-
Filesize
306B
MD5d7c10b603f08166a75933612b455225e
SHA101440f67694ccf9f0b6ed53a5534743dff6b84fc
SHA2564f16326bb7b4f8dca7e7f2f16a04baf2a32f1bd450118d1e85e51a1a36abc9dc
SHA5120722628264707678ec67c5459eddc77c6df6649645270e8c27e80768be6b0d64da095ca60dc30d57e4d37a1903070371f6ee36c33f874002548febd8021ebb34
-
Filesize
22.0MB
MD57358d518d8690795fe75161d3725fbc9
SHA1a27fca419ac99a4bd94c3388acaa78f4a6cb00f7
SHA256ad191a230f5454c93c8c237c6cd9d656de6932fdd5440188bd2c8d1904b4c098
SHA512f7315e041696bf16737cc3bbb95d75c95f208005cf4ac399cbbfb3bd7edff48a6e47e4e353c4b08a5cfbe030610ebb250139a2cf08061191aff42f9642c72a51