Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 18:58
Static task
static1
Behavioral task
behavioral1
Sample
b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe
-
Size
371KB
-
MD5
b070d7dc7508bfa4054ada3ba72ea8ce
-
SHA1
d2d11aee9b38e96c1dfcf99a6251216943319f4d
-
SHA256
4a0423842fcce82e76511cd8a0ec7cb67becae01b6213c6907164570deecdfee
-
SHA512
0377fde47c3efcad3006cfc1ddf73cecd87c807163ad6629fe343cb382e9bee7898b1b1475d4eccaa70767131fdd9e7ad8b03549cd676a6ddbae5a94525e62b5
-
SSDEEP
6144:ALNk6l1WtdwKLm5BBoVJmoqEA1e54ye2SblCRptCFR1loJm4/NCXGNHf:0Nk6rWtCPEHqN1e5LCbYyx4VVH
Malware Config
Signatures
-
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\office.exe c0790.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\office.exe c0790.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\office.exe b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2512 c0790.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\c0790.exe b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe File created C:\Windows\c0790.exe b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0790.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 2512 c0790.exe Token: SeIncBasePriorityPrivilege 2512 c0790.exe Token: 33 1360 b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1360 b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1360 wrote to memory of 2512 1360 b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe 87 PID 1360 wrote to memory of 2512 1360 b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe 87 PID 1360 wrote to memory of 2512 1360 b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b070d7dc7508bfa4054ada3ba72ea8ce_JaffaCakes118.exe"1⤵
- Drops startup file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\c0790.exeC:\Windows\c0790.exe2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
371KB
MD5b070d7dc7508bfa4054ada3ba72ea8ce
SHA1d2d11aee9b38e96c1dfcf99a6251216943319f4d
SHA2564a0423842fcce82e76511cd8a0ec7cb67becae01b6213c6907164570deecdfee
SHA5120377fde47c3efcad3006cfc1ddf73cecd87c807163ad6629fe343cb382e9bee7898b1b1475d4eccaa70767131fdd9e7ad8b03549cd676a6ddbae5a94525e62b5