Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2024, 01:20
Static task
static1
Behavioral task
behavioral1
Sample
b5cd24b6ab78fd726972b3fbd1c57a1b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b5cd24b6ab78fd726972b3fbd1c57a1b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b5cd24b6ab78fd726972b3fbd1c57a1b_JaffaCakes118.exe
-
Size
46KB
-
MD5
b5cd24b6ab78fd726972b3fbd1c57a1b
-
SHA1
acdf0b79492d6ffc8e3d9ba4c571e23331c00c59
-
SHA256
7d21b6b50d0b8ad74b48e8f682f85c25715e5b390be3a590fa2b2eedeec6e911
-
SHA512
9bf04f83abaec4ce47c04aa7975dc64d46a783eca64cfaa4af38482e95bad31fa53e71ca63bf5ccaac7f478ad81e627b831c7749abda773e91461915a0fdb41a
-
SSDEEP
768:9vdJOlEef4XNvJ4/acva8ibGx/fGGfcGfRndJHd3d1djGdFdodJzdV:9HZefm34/acAGVuGkG9PD
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update Client = "C:\\Windows\\system32\\wuclient.exe" b5cd24b6ab78fd726972b3fbd1c57a1b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XPSP2 Firewall = "C:\\Windows\\system32\\xpsp2fw.exe" b5cd24b6ab78fd726972b3fbd1c57a1b_JaffaCakes118.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wuclient.exe b5cd24b6ab78fd726972b3fbd1c57a1b_JaffaCakes118.exe File created C:\Windows\SysWOW64\xpsp2fw.exe b5cd24b6ab78fd726972b3fbd1c57a1b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xpsp2fw.exe b5cd24b6ab78fd726972b3fbd1c57a1b_JaffaCakes118.exe File created C:\Windows\SysWOW64\wuclient.exe b5cd24b6ab78fd726972b3fbd1c57a1b_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b5cd24b6ab78fd726972b3fbd1c57a1b_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5cd24b6ab78fd726972b3fbd1c57a1b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b5cd24b6ab78fd726972b3fbd1c57a1b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4956