Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 01:21
Static task
static1
Behavioral task
behavioral1
Sample
a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe
-
Size
748KB
-
MD5
a4d5eeb07bb81d0c99911a57a02d058b
-
SHA1
904574e54f910793a3fe9f912d0911293350e4f4
-
SHA256
92d1c63c4d8eb86dcb20961260b3cc92cafa4fd22889ba04ce63d7467abc67b7
-
SHA512
1782cfcf668ebce1d71705d4f4da79a17ae1ad703850803ae3aab41f2002f5bfa3dbb4d951c55f7f4526b03e2db62db0e9d9553a46f820a25406b7ba09ac4df3
-
SSDEEP
12288:NYLIHAa68vN/+nc6FwDqCpi96x58P1lAXGNrspt95Ehay8urkPz0TuTcj06K6:hgaJv5+ckw3pia5svT8uG0TuQjpR
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3920 B6232F3A9D9.exe 3952 B6232F3A9D9.exe 804 8O3B99B.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/224-2-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/224-6-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/224-5-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/224-4-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/224-9-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/224-11-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/224-12-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/224-10-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/224-8-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/224-7-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/224-18-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/3952-29-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/3952-28-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/3952-32-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/3952-33-0x0000000000400000-0x00000000004DA000-memory.dmp upx behavioral2/memory/3952-40-0x0000000000400000-0x00000000004DA000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4Y3Y0C3A1F7XZHYWCWWWEZ = "C:\\Recycle.Bin\\B6232F3A9D9.exe /q" 8O3B99B.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4488 set thread context of 224 4488 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 93 PID 3920 set thread context of 3952 3920 B6232F3A9D9.exe 98 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6232F3A9D9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6232F3A9D9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8O3B99B.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Internet Explorer\PhishingFilter 8O3B99B.exe Set value (int) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" 8O3B99B.exe Set value (int) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0" 8O3B99B.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Internet Explorer\Recovery 8O3B99B.exe Set value (int) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0" 8O3B99B.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 224 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 224 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 224 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 224 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 3952 B6232F3A9D9.exe 3952 B6232F3A9D9.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe 804 8O3B99B.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 224 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe Token: SeDebugPrivilege 224 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe Token: SeDebugPrivilege 224 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe Token: SeDebugPrivilege 224 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe Token: SeDebugPrivilege 3952 B6232F3A9D9.exe Token: SeDebugPrivilege 3952 B6232F3A9D9.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe Token: SeDebugPrivilege 804 8O3B99B.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4488 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 3920 B6232F3A9D9.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4488 wrote to memory of 224 4488 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 93 PID 4488 wrote to memory of 224 4488 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 93 PID 4488 wrote to memory of 224 4488 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 93 PID 4488 wrote to memory of 224 4488 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 93 PID 4488 wrote to memory of 224 4488 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 93 PID 4488 wrote to memory of 224 4488 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 93 PID 4488 wrote to memory of 224 4488 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 93 PID 4488 wrote to memory of 224 4488 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 93 PID 224 wrote to memory of 3920 224 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 94 PID 224 wrote to memory of 3920 224 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 94 PID 224 wrote to memory of 3920 224 a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe 94 PID 3920 wrote to memory of 3952 3920 B6232F3A9D9.exe 98 PID 3920 wrote to memory of 3952 3920 B6232F3A9D9.exe 98 PID 3920 wrote to memory of 3952 3920 B6232F3A9D9.exe 98 PID 3920 wrote to memory of 3952 3920 B6232F3A9D9.exe 98 PID 3920 wrote to memory of 3952 3920 B6232F3A9D9.exe 98 PID 3920 wrote to memory of 3952 3920 B6232F3A9D9.exe 98 PID 3920 wrote to memory of 3952 3920 B6232F3A9D9.exe 98 PID 3920 wrote to memory of 3952 3920 B6232F3A9D9.exe 98 PID 3952 wrote to memory of 804 3952 B6232F3A9D9.exe 99 PID 3952 wrote to memory of 804 3952 B6232F3A9D9.exe 99 PID 3952 wrote to memory of 804 3952 B6232F3A9D9.exe 99 PID 3952 wrote to memory of 804 3952 B6232F3A9D9.exe 99 PID 3952 wrote to memory of 804 3952 B6232F3A9D9.exe 99 PID 804 wrote to memory of 224 804 8O3B99B.exe 93 PID 804 wrote to memory of 224 804 8O3B99B.exe 93 PID 804 wrote to memory of 224 804 8O3B99B.exe 93 PID 804 wrote to memory of 224 804 8O3B99B.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a4d5eeb07bb81d0c99911a57a02d058b_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Recycle.Bin\B6232F3A9D9.exe"C:\Recycle.Bin\B6232F3A9D9.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Recycle.Bin\B6232F3A9D9.exe"C:\Recycle.Bin\B6232F3A9D9.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\8O3B99B.exe"C:\Users\Admin\AppData\Local\Temp\8O3B99B.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
748KB
MD5a4d5eeb07bb81d0c99911a57a02d058b
SHA1904574e54f910793a3fe9f912d0911293350e4f4
SHA25692d1c63c4d8eb86dcb20961260b3cc92cafa4fd22889ba04ce63d7467abc67b7
SHA5121782cfcf668ebce1d71705d4f4da79a17ae1ad703850803ae3aab41f2002f5bfa3dbb4d951c55f7f4526b03e2db62db0e9d9553a46f820a25406b7ba09ac4df3
-
Filesize
492KB
MD5383ebf8a32a4a4679ea335c546d71f9f
SHA112e5c95df63f2cc00df20e5c0fe8dc5c39343263
SHA256b7b1103b82e47f8c39ab5e8f56150de37b06d579944c6c051c2b569be992aa00
SHA512a291ab3d4cf2b5bf4ec03d345a4b2656a46f67ba4e4ffdbee37085b105162491dbf1e736eae1dea204398229decd5f8c853c82a04a4426c960511863aa7fa77a
-
Filesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be