Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
-
Size
171KB
-
MD5
afd03cc2451544013c039c7c6839b60e
-
SHA1
1af9eb447a070e3aa1dec9421b95e21982e6906e
-
SHA256
bd46f502707f595e6dbef85222e095e9a718b40b4ea4b8fb1b1939176bcebfa2
-
SHA512
5128b7350744f6134cfcb98ec4c5539006511ae514bd4872c4b57d1229f857fb4f7cebd3f52099119b5baf182d9a58be89ee09022cd8eee3a4feee6dad892e6a
-
SSDEEP
3072:32SZu4jTJAGMeJjKJGsv4TUcNV5T5H0S6kanQXzeZGVxVp3cmcTqy163xigHI3Bw:mSZt+GT6GsWV5TFn6JQXLbIaxpHI3B9
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1972 afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cltmon = "C:\\Windows\\system32\\cltmon.exe" afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe -
Modifies WinLogon 2 TTPs 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\DllName = "C:\\Windows\\system32\\omhdt32.dll" afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Logon = "fnGbf2" afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Shutdown = "fnGbf2" afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Impersonate = "0" afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Startup = "fnGbf2" afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\StartShell = "fnGbf2" afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Logoff = "fnGbf2" afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Asynchronous = "0" afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dllcache\smdata32 afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dllcache\smdata32\msn afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dllcache\smdata32\tr4ckd afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dllcache\smdata32\remdsk afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dllcache\smdata32\fxddsk afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe File created C:\Windows\SysWOW64\cltmon.exe afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllcache\smdata32\odTxt.dat afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dllcache\smdata32\inf0z afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dllcache\smdata32\Temporary Internet Files afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe File created C:\Windows\SysWOW64\omhdt32.dll afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\omhdt32.dll afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dllcache\smdata32\odTxt.dat afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1" afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1972 afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe 1972 afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe 1972 afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe 1972 afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1972 afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe 1972 afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD5573afac0a8420c5019d8adcfdd9c04f6
SHA1533147404d575baa0300491cfa5ad442a3ca5548
SHA25605c6b5febc0e815a02ba8ef348d3f28d079a3cfbc4b9e3442edf4225baad8b7c
SHA512db3e3077ab5c8fc1d4e1fdb28088af97c1fe31bc59df6716fc91b9dfc09c2ffda7a42682150f253a0c51bb6c515a93cc9f35033989aff7343547b257047e394c