Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 18:47
Static task
static1
Behavioral task
behavioral1
Sample
a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
a3b59b53d953afe83eb9cdf2bdffe1bd
-
SHA1
23185a599f98c87478977a0ad2179c4cfe182ceb
-
SHA256
eb133d877c0b7b3ee8a931503904b310a490c978f6d96ac8863d86ff0371ee44
-
SHA512
7b8785de8e9e73ef6b5bf0e6d57105652f68f5a0bdd947a41b0e426f158879404b2a0dc1f8ef13b0af80a3731e1b5d78cefc09df586c89a466a967542e60b486
-
SSDEEP
24576:BPuFhCwUuqDluBMfEhJX3z5mKhwbLeoMKMC:GhxqDosEL3F/w+KMC
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe -
Executes dropped EXE 4 IoCs
pid Process 2276 smes.exe 4876 smes.exe 1616 smes.exe 2436 smes.exe -
Loads dropped DLL 6 IoCs
pid Process 808 a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe 808 a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe 1616 smes.exe 2436 smes.exe 2436 smes.exe 2436 smes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 808 a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe 808 a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2276 smes.exe Token: SeDebugPrivilege 4876 smes.exe Token: SeDebugPrivilege 1616 smes.exe Token: 33 1616 smes.exe Token: SeIncBasePriorityPrivilege 1616 smes.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2436 smes.exe 2436 smes.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 808 wrote to memory of 3076 808 a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe 87 PID 808 wrote to memory of 3076 808 a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe 87 PID 808 wrote to memory of 3076 808 a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe 87 PID 808 wrote to memory of 4004 808 a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe 89 PID 808 wrote to memory of 4004 808 a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe 89 PID 808 wrote to memory of 4004 808 a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe 89 PID 3076 wrote to memory of 2276 3076 cmd.exe 91 PID 3076 wrote to memory of 2276 3076 cmd.exe 91 PID 3076 wrote to memory of 2276 3076 cmd.exe 91 PID 3076 wrote to memory of 4876 3076 cmd.exe 92 PID 3076 wrote to memory of 4876 3076 cmd.exe 92 PID 3076 wrote to memory of 4876 3076 cmd.exe 92 PID 1616 wrote to memory of 2436 1616 smes.exe 94 PID 1616 wrote to memory of 2436 1616 smes.exe 94 PID 1616 wrote to memory of 2436 1616 smes.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3b59b53d953afe83eb9cdf2bdffe1bd_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\smes\u.bat"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\ProgramData\smes\smes.exesmes.exe -install3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
C:\ProgramData\smes\smes.exesmes.exe -start3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4876
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat"2⤵
- System Location Discovery: System Language Discovery
PID:4004
-
-
C:\ProgramData\smes\smes.exeC:\ProgramData\smes\smes.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\ProgramData\smes\smes.exeC:\ProgramData\smes\smes.exe -run2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
718B
MD50318d2f94f0145e80c51bfbb3aed769d
SHA1ba8ec32df73b8539eeca46f39e29a4e9af371ea1
SHA25658ea7e766662ed6cd9274313db7824261e16246b2b0d232b973d8e76a1291e43
SHA51200312951c03f6f0caf88d7ad0537c7b29c425d4b4ba08975f2d7a1ac222aa15611488b7fd7b31229aada46d4c0df4d68affe8bdbd860f7aadcaa03e39ead312b
-
Filesize
202B
MD52817d860dcda80e85d44469632071f90
SHA1d62722ee64c73318183ac86ecb5757a9bf7b0580
SHA256bc69b15d05da1d66019902f1a3afc4c5d0b8e9a4ea508e30e522b56b121aa33d
SHA51222092092c1676185cb8f50e2d4e6fb75796ccf70d905f89295b00dae0dc201b9576f7cfabfdb437da0880c3c22ee644d864ca169a6b36aa65c2c657b0c41bee0
-
Filesize
448B
MD5be4150c92d44393b7e9431bc6f807eb1
SHA1a3af77de4c802212e0e0d5ee60c1d74cad12c142
SHA256ae341367e6e47b8aa460fdcf21668f71529ce6e53e22a0a7e758a17404f35b8b
SHA5128855b9f3f20c5fdd4750ae3a770d32e0c75c8bdd0c03bed85d61016691d3f07591c57b799ecba1492e79f685af08733e5047fd2fd1f47e8c23d10ce9506decdd
-
Filesize
546B
MD5accfac4e4fbcc4f8f33d8ce7197e9036
SHA15b6abd41931e36ac7558b9fce8fc980eb072f900
SHA256f8375ac2fe5104590051aa4110c53e897e25c47850ef8d9139664439eb5c3252
SHA512331d7ee450e41766d2114532154766a95fd57b8df78550274215b14eb7e3f9d12c3a46d2051001d4a6824f9b8dfdc4a7c37179402aabfeb26b81b62fd338bdb4
-
Filesize
441KB
MD57851449473178f9782263d51bc5e3bbc
SHA1ad5148ee1bed2348b320c62c025d52fbcbb28799
SHA256c3bc7ec8428f0bb210a0597c9a0cad1be412b7fa46ea006819a3df9ac23118b4
SHA512b01fc37ac84b81df8d7657000295aed7eb50aaf7f13ab2b2be9030c9f83ed1559318c83c78b4a29926d7d30e9eea9538d123ef4a649179be5a5b54ee71ed9b49
-
Filesize
425KB
MD5bf5dcfd9da0514334d41cbd80d2a9138
SHA1802f9e0b82edca56be08a33b2ba874b34c31f1e3
SHA256f9506cf9a87aa6bfbf07f2124f2785a711b27a70839ebb95bdd4b2cf747fb060
SHA512246796f2e201cde30043eaa2c0ffb4d2b3bea2bae97261a022824c31a42d2b08998b1bdcd436e8392bdd153dd6fadf9ba69361c7316a6bfda5d475678b7aa5cc
-
Filesize
433KB
MD545199dab51eeece95728abfe25e18f35
SHA159ab0fe25aa2adc253adbecba6862e7432df1c39
SHA256a22006861cac6a849346282e2f7729deeb8f68bf29f13c15ae33d20311f77391
SHA512825c6ae1f88cec3d6c469e6a15cad0430845ecc8d436777092f4c5fe8ecd02abbfeb3e2a17b2f4896b9d6e4b2d229a8b83bfdda75a3e025fc32f86610c6eef12
-
Filesize
209KB
MD51fa47f5b173cee5ef9c3ee1bda0c321e
SHA160ee40236f960affb01d569a32e1b05888bb081a
SHA256b21526716068d2a8550780038e2b5ddb843d77890a07ec82ed9ce9dd0be52c64
SHA51201f39376269a75510347fcf66ff2585b25d5e6e10e26b7feefa3af66e712a5f50c62bff6d40abee733e1ce965d17a2e443664838268eb7c7a2e36fc1c024224d
-
Filesize
44B
MD5704efba1aee1454561da552dda430498
SHA1d20fb96683f769eb9cef1b0a068bcba70aeab9c2
SHA25680b08d35bd27636e0774ce35ab57306f76edc6a0f7058cb1f93733cdf88bf94c
SHA5127e0c9ede686238703af4893af8842c05c48ab1681ae273b32d8085cf1a17aae946c0c823a0a418787522a551d684367259ff8203ebca6e4ec69b6ded95231bd0
-
Filesize
10KB
MD5055f4f9260e07fc83f71877cbb7f4fad
SHA1a245131af1a182de99bd74af9ff1fab17977a72f
SHA2564209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc
SHA512a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
135B
MD5928105cceffc886d30e1eea7d1d42cde
SHA1daf202670dcdeddbc673967e79ede92256a84d92
SHA256e573a2b0c8c062297b8d5c924c390eff04aae7834e6ecd867735c2185b992238
SHA512e3d963c2a89bc479be493662ad7e3068a3b9df65047314e978ab3e4b68d5379aa6305f6969663c5702246e5a5b87ff0db8cc0126fadb8698c1dbe8aa30e0aead