Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 20:41
Behavioral task
behavioral1
Sample
a821f71990cda50d875b788a786cabea_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a821f71990cda50d875b788a786cabea_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a821f71990cda50d875b788a786cabea_JaffaCakes118.exe
-
Size
917KB
-
MD5
a821f71990cda50d875b788a786cabea
-
SHA1
4fc22ce876181e032f9d90384b35b30429ad2c23
-
SHA256
43b377ad4d39ee0c6a29f9e1610932eb0008c1e9a55d3bdb1743968b16bfbc76
-
SHA512
856acc121b675824cf2efe0fbe1c5e0cdc3aa367578d67f00cbc1e64a76657d9f2d4df6230bf0ee9b53e7d6a7702b36a70456e123207918b0c249392e03bc887
-
SSDEEP
24576:RIa7MvMoIceaNc+IBDnAggZhefKsZKnOI5:Rg0GesGZKnf5
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/640-0-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/640-18-0x0000000000400000-0x00000000004E7000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\TaoBao\СÓÎÏ·.ico a821f71990cda50d875b788a786cabea_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\TaoBao\ÌÔ±¦.ico a821f71990cda50d875b788a786cabea_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\RtkSYUdp.exe a821f71990cda50d875b788a786cabea_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a821f71990cda50d875b788a786cabea_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe -
description ioc Process Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\internet explorer\version Vector a821f71990cda50d875b788a786cabea_JaffaCakes118.exe -
Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ = "lnkfile" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{000214EE-0000-0000-C000-000000000046}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{000214F9-0000-0000-C000-000000000046} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{000214F9-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{00021401-0000-0000-C000-000000000046}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1 regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{000214EE-0000-0000-C000-000000000046} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{000214EE-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\PersistentHandler\ = "{5e941d80-bf96-11cd-b579-08002b30bfeb}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{00021500-0000-0000-C000-000000000046} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{CABB0DA0-DA57-11CF-9974-0020AFD79762} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{00021500-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{00021500-0000-0000-C000-000000000046} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellNew regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ = "InternetShortcut" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{000214F9-0000-0000-C000-000000000046}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{00021500-0000-0000-C000-000000000046}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{FBF23B80-E3F0-101B-8488-00AA003E56F8}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\PersistentHandler regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{000214F9-0000-0000-C000-000000000046} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{CABB0DA0-DA57-11CF-9974-0020AFD79762}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{000214EE-0000-0000-C000-000000000046} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{FBF23B80-E3F0-101B-8488-00AA003E56F8} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellNew\Command = "rundll32.exe appwiz.cpl,NewLinkHere %1" regedit.exe -
Runs regedit.exe 2 IoCs
pid Process 4692 regedit.exe 2288 regedit.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 640 wrote to memory of 4692 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 85 PID 640 wrote to memory of 4692 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 85 PID 640 wrote to memory of 4692 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 85 PID 640 wrote to memory of 2288 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 86 PID 640 wrote to memory of 2288 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 86 PID 640 wrote to memory of 2288 640 a821f71990cda50d875b788a786cabea_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a821f71990cda50d875b788a786cabea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a821f71990cda50d875b788a786cabea_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\regedit.exeregedit /s C:\Users\Admin\AppData\Local\Temp\$rar10656.tmp2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Runs regedit.exe
PID:4692
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s C:\Users\Admin\AppData\Local\Temp\$10943.tmp2⤵
- System Location Discovery: System Language Discovery
- Runs regedit.exe
PID:2288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f9ce5c8a3059991babf4084151caa492
SHA126567f89a885b0e69f24309c3e5c58e8e938f841
SHA256e82c214f33cad1b25146758e22fd887b15f63b1a7a8d716b358c50dc5c3d4e96
SHA512cce48827588aa5968453a8a69baeab8435083dca1d625d079b01d4f9292c7bcb85ab1217f1cf96ea301eef49b7a96a76b58413d4496f1c35e234df7c7e5c9750