Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 15:18
Static task
static1
Behavioral task
behavioral1
Sample
afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe
-
Size
68KB
-
MD5
afbfb8ee1118aa89a519f72a9209d771
-
SHA1
d61b263ddc1d60006d6312a2badaa2abc3c73f27
-
SHA256
6a8b69b186425d99274e2f062cf6e4dba5d97626331708c2dc20c2e393b9db99
-
SHA512
869698d78a22a3337d9c2e3a7ec64013d0441a8822351c306e7d4d36fdc7b1c2a9ae21cf998a06c26e1ab0058b10ce90928e1c1462c132938ca27e0166d93d9d
-
SSDEEP
1536:r1BvK2hM46fGBCzSfNNI6yx8Hoh3eypmrYbwWoe:r1BvK7pmCzSlNILr7mrle
Malware Config
Signatures
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3632 set thread context of 1472 3632 afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3632 wrote to memory of 1472 3632 afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe 84 PID 3632 wrote to memory of 1472 3632 afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe 84 PID 3632 wrote to memory of 1472 3632 afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe 84 PID 3632 wrote to memory of 1472 3632 afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe 84 PID 3632 wrote to memory of 1472 3632 afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe 84 PID 3632 wrote to memory of 1472 3632 afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe 84 PID 3632 wrote to memory of 1472 3632 afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe 84 PID 3632 wrote to memory of 1472 3632 afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe 84 PID 3632 wrote to memory of 1472 3632 afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\afbfb8ee1118aa89a519f72a9209d771_JaffaCakes118.exe"2⤵PID:1472
-