Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe
-
Size
366KB
-
MD5
b1a7807a330c69927d64d7f320a2912c
-
SHA1
428247d7c9e9b345f840ee597d0a9850020377e7
-
SHA256
3967f49c15abb7678bc86b25943f5e3f1b56c19eb7f30a066a03b41c78fa2ef0
-
SHA512
76317edd83a8f5d1621d292138961fda9c8f5f1cc6e86f05342da0ca590a1d1e8a790c2dcb94e0b48fc86a9822a2ad9024549b8792bc4c76d0b64df6abb3a485
-
SSDEEP
6144:ZwlyFsMF2idZecnl20lHRxp3g7OwO4Q9Ch+KfHUJAKv88Wd7fsPVZMGg1fz2/3aI:qlW3F3Z4mxx6eCPpa88WpfGVZMGN/KI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2100 servet.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\servet.exe b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\servet.exe b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\servet.exe servet.exe File created C:\Windows\SysWOW64\Deledomn.bat b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language servet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2952 wrote to memory of 2100 2952 b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe 87 PID 2952 wrote to memory of 2100 2952 b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe 87 PID 2952 wrote to memory of 2100 2952 b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe 87 PID 2952 wrote to memory of 4396 2952 b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe 88 PID 2952 wrote to memory of 4396 2952 b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe 88 PID 2952 wrote to memory of 4396 2952 b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b1a7807a330c69927d64d7f320a2912c_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\servet.exeC:\Windows\system32\servet.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2100
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Deledomn.bat2⤵
- System Location Discovery: System Language Discovery
PID:4396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD55e5e0820484d112a24cc87583d78321e
SHA16596e8fe95aa552e46e20a2a5467feb07115ad21
SHA256f38eff5bee358e661a9bd4bfe22633fab52fe7e5e26a981b726f0469954ba28c
SHA5126533dd0ff4bf08326b4f5d5b0459c2b4afc683609dc3d68184cf97bcd803e2daf3dbdbf03a5c158642bc50c56542c47d84ab9554452cb5f585346bcf48e337d7
-
Filesize
366KB
MD5b1a7807a330c69927d64d7f320a2912c
SHA1428247d7c9e9b345f840ee597d0a9850020377e7
SHA2563967f49c15abb7678bc86b25943f5e3f1b56c19eb7f30a066a03b41c78fa2ef0
SHA51276317edd83a8f5d1621d292138961fda9c8f5f1cc6e86f05342da0ca590a1d1e8a790c2dcb94e0b48fc86a9822a2ad9024549b8792bc4c76d0b64df6abb3a485