Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2024, 02:11
Static task
static1
Behavioral task
behavioral1
Sample
b5f3e35db796dad76bb85f25024cdcb5_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b5f3e35db796dad76bb85f25024cdcb5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b5f3e35db796dad76bb85f25024cdcb5_JaffaCakes118.exe
-
Size
455KB
-
MD5
b5f3e35db796dad76bb85f25024cdcb5
-
SHA1
7587d5da01cbe188df6d1da46ba4e032dbc87d7f
-
SHA256
b718e351345939bf2b6625a35a9e7a8ac83b97ff5fc9a7fcf035eab052d7d060
-
SHA512
0494ea9a26ef7d8fc798b3d336eb730f361689e7123b75952bb5535982b29a7d29d814ffe26cf594612e56a0ae1dbbb4d4607d9bf2d35be8065bee3c2a65c09f
-
SSDEEP
12288:R/a9yzIb1R/SkZ9iSnhI4ye4r4rkylm1S81FDXXmw:lCyzIbnSkZ9i34yvr4rkyMtXr
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1548 a3406HcNcClG6135.exe -
Executes dropped EXE 1 IoCs
pid Process 1548 a3406HcNcClG6135.exe -
resource yara_rule behavioral2/memory/2520-2-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/2520-11-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/2520-12-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1548-14-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1548-17-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1548-25-0x0000000000400000-0x00000000004C7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\a3406HcNcClG6135 = "C:\\ProgramData\\a3406HcNcClG6135.exe" a3406HcNcClG6135.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b5f3e35db796dad76bb85f25024cdcb5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a3406HcNcClG6135.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2520 b5f3e35db796dad76bb85f25024cdcb5_JaffaCakes118.exe 2520 b5f3e35db796dad76bb85f25024cdcb5_JaffaCakes118.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2520 b5f3e35db796dad76bb85f25024cdcb5_JaffaCakes118.exe Token: SeDebugPrivilege 1548 a3406HcNcClG6135.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1548 a3406HcNcClG6135.exe 1548 a3406HcNcClG6135.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2520 wrote to memory of 1548 2520 b5f3e35db796dad76bb85f25024cdcb5_JaffaCakes118.exe 87 PID 2520 wrote to memory of 1548 2520 b5f3e35db796dad76bb85f25024cdcb5_JaffaCakes118.exe 87 PID 2520 wrote to memory of 1548 2520 b5f3e35db796dad76bb85f25024cdcb5_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5f3e35db796dad76bb85f25024cdcb5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b5f3e35db796dad76bb85f25024cdcb5_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\ProgramData\a3406HcNcClG6135.exe"C:\ProgramData\a3406HcNcClG6135.exe" "C:\Users\Admin\AppData\Local\Temp\b5f3e35db796dad76bb85f25024cdcb5_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
455KB
MD5d15650530d438b5498971edcc9877247
SHA19f794527b6a1fff467fae71b2c7fb42915fd6945
SHA25617c110ff03d994ce57cf2dd547c9a0bc1a10e45e77c7242d22bad5731666cd08
SHA5120f6091bd9b87f249044e31fef6f9f78f9c43968e334a2a70deac1842c6ae77d481f5adb6ebfb1986507d3aa71d8694e9584abd8063926a4bc59c631dec01bb0e