Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 20:59
Static task
static1
Behavioral task
behavioral1
Sample
ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
ac8d64159f01bd2beabb491d3ade5804
-
SHA1
6a910e8241c2db1b3352ab71f764718f60777315
-
SHA256
d06eed697b1fd60b51f083b5f186d0dfc081355bffd02f7fdf72b89e2ae9552c
-
SHA512
b11d16e75ab391b893684cc068f9a5948bd3980a37cf50370ed0848bdfdbf4790433e03a84ffa49ef431773a5642a2d93244b7ed801aa3c6ef9ddfb2278e40ce
-
SSDEEP
24576:BkuFhCwUuqDluBMfEhJX3z5mKhwbLeoMbd:PhxqDosEL3F/w+bd
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe -
Executes dropped EXE 4 IoCs
pid Process 3296 smes.exe 2764 smes.exe 2960 smes.exe 1192 smes.exe -
Loads dropped DLL 6 IoCs
pid Process 2284 ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe 2284 ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe 2960 smes.exe 1192 smes.exe 1192 smes.exe 1192 smes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2284 ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe 2284 ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3296 smes.exe Token: SeDebugPrivilege 2764 smes.exe Token: SeDebugPrivilege 2960 smes.exe Token: 33 2960 smes.exe Token: SeIncBasePriorityPrivilege 2960 smes.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1192 smes.exe 1192 smes.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2284 wrote to memory of 4960 2284 ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe 87 PID 2284 wrote to memory of 4960 2284 ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe 87 PID 2284 wrote to memory of 4960 2284 ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe 87 PID 2284 wrote to memory of 1744 2284 ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe 89 PID 2284 wrote to memory of 1744 2284 ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe 89 PID 2284 wrote to memory of 1744 2284 ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe 89 PID 4960 wrote to memory of 3296 4960 cmd.exe 91 PID 4960 wrote to memory of 3296 4960 cmd.exe 91 PID 4960 wrote to memory of 3296 4960 cmd.exe 91 PID 4960 wrote to memory of 2764 4960 cmd.exe 92 PID 4960 wrote to memory of 2764 4960 cmd.exe 92 PID 4960 wrote to memory of 2764 4960 cmd.exe 92 PID 2960 wrote to memory of 1192 2960 smes.exe 94 PID 2960 wrote to memory of 1192 2960 smes.exe 94 PID 2960 wrote to memory of 1192 2960 smes.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ac8d64159f01bd2beabb491d3ade5804_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\smes\u.bat"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\ProgramData\smes\smes.exesmes.exe -install3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3296
-
-
C:\ProgramData\smes\smes.exesmes.exe -start3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat"2⤵
- System Location Discovery: System Language Discovery
PID:1744
-
-
C:\ProgramData\smes\smes.exeC:\ProgramData\smes\smes.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\ProgramData\smes\smes.exeC:\ProgramData\smes\smes.exe -run2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1192
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720B
MD5ffc3088dc68b14616fc334ce25f7c4ec
SHA183ea5e504ba582fd0db81371888b2d2d36012af8
SHA256f39e009b78bbca138cf7ca72023390afe0e9ab1980eb0e326e637186a1249872
SHA512b3c29e4513ba21d9588661eeffe029bdc5a2317cb3345cbe945f50df9688732d478e614e67a64f87d9cdf2c284eaeb9c497feef69ee71a621f4fc009bf1c09b4
-
Filesize
202B
MD510e2f435d3a3e9674c35c4e38047ff89
SHA1bd8d7907e98a8057010f2444a8f877fda4788857
SHA256f8253d28db8bb9be20662470d39d110cd3e6e5f38dee138161f91245a5066154
SHA512ed6527902d4beb2bd1fa2b92fffc3b0a552fde698de89ccf5535c444fca008208efb3ead995f77fbbf25b5637122f001970287e3e7fc5a9c7152313002beb878
-
Filesize
448B
MD5d2faa3ae76eba05954b4f10504dfef37
SHA155b42a5a950b268fd1b72f28946e572635221f95
SHA25609a5555023530330920f9e922c6dac9cc2052ffd24463a33a5d4f98387ff17eb
SHA5128bace069d02d7e6b5ec1bf918697c22c0ba0b275e2c53c438e4c4d44f4cbc1bcf7b27fc83601c0f82307199f964acf046bed0a624ff6472d031e0b42632d07fb
-
Filesize
546B
MD55658a12c0157186e48705073fab3bae6
SHA12fc92dbf7cc22a6b768579b56f560ba3ed365dc4
SHA2562711c2e519980fc1cda5eb543a888e5ea13f0ce2d9923b6641890edfe0403bc4
SHA5126fa2591294789d019d927f2e7d223d9e12aca2d140d3ddd18561ad6ffbff60813202199a91dacb8ae033c0e57c16db3f0645caeeef7e8cba971176169642a878
-
Filesize
441KB
MD57851449473178f9782263d51bc5e3bbc
SHA1ad5148ee1bed2348b320c62c025d52fbcbb28799
SHA256c3bc7ec8428f0bb210a0597c9a0cad1be412b7fa46ea006819a3df9ac23118b4
SHA512b01fc37ac84b81df8d7657000295aed7eb50aaf7f13ab2b2be9030c9f83ed1559318c83c78b4a29926d7d30e9eea9538d123ef4a649179be5a5b54ee71ed9b49
-
Filesize
425KB
MD5bf5dcfd9da0514334d41cbd80d2a9138
SHA1802f9e0b82edca56be08a33b2ba874b34c31f1e3
SHA256f9506cf9a87aa6bfbf07f2124f2785a711b27a70839ebb95bdd4b2cf747fb060
SHA512246796f2e201cde30043eaa2c0ffb4d2b3bea2bae97261a022824c31a42d2b08998b1bdcd436e8392bdd153dd6fadf9ba69361c7316a6bfda5d475678b7aa5cc
-
Filesize
433KB
MD545199dab51eeece95728abfe25e18f35
SHA159ab0fe25aa2adc253adbecba6862e7432df1c39
SHA256a22006861cac6a849346282e2f7729deeb8f68bf29f13c15ae33d20311f77391
SHA512825c6ae1f88cec3d6c469e6a15cad0430845ecc8d436777092f4c5fe8ecd02abbfeb3e2a17b2f4896b9d6e4b2d229a8b83bfdda75a3e025fc32f86610c6eef12
-
Filesize
209KB
MD51fa47f5b173cee5ef9c3ee1bda0c321e
SHA160ee40236f960affb01d569a32e1b05888bb081a
SHA256b21526716068d2a8550780038e2b5ddb843d77890a07ec82ed9ce9dd0be52c64
SHA51201f39376269a75510347fcf66ff2585b25d5e6e10e26b7feefa3af66e712a5f50c62bff6d40abee733e1ce965d17a2e443664838268eb7c7a2e36fc1c024224d
-
Filesize
44B
MD5704efba1aee1454561da552dda430498
SHA1d20fb96683f769eb9cef1b0a068bcba70aeab9c2
SHA25680b08d35bd27636e0774ce35ab57306f76edc6a0f7058cb1f93733cdf88bf94c
SHA5127e0c9ede686238703af4893af8842c05c48ab1681ae273b32d8085cf1a17aae946c0c823a0a418787522a551d684367259ff8203ebca6e4ec69b6ded95231bd0
-
Filesize
10KB
MD5055f4f9260e07fc83f71877cbb7f4fad
SHA1a245131af1a182de99bd74af9ff1fab17977a72f
SHA2564209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc
SHA512a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
135B
MD524754f38c37910d748a5dd1c45daf9ab
SHA162d87cd516c59039c94a5426e4f630c142931fa3
SHA25663cea6b342ddff35ec0f99411d689533282132f079553dc4d504ee3143c9dcfc
SHA5128de5c6df3b62f28dee31f647dfb05c7f54a34bb4946d54b1184e499c10b34472f58189474bfb72c4755cbb87e04fd064c1ec7acd20c79d511371bf09033e6aa2