Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2024, 04:11
Behavioral task
behavioral1
Sample
b64b9829be04d3651f1ff1fab7aa51dc_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b64b9829be04d3651f1ff1fab7aa51dc_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
b64b9829be04d3651f1ff1fab7aa51dc
-
SHA1
9b909db2f631c8c5046e387a7f924f4319a3f345
-
SHA256
3cc54a630c9072d21e7882f5c088e82910e81078bcdacded72f05cec13f3f707
-
SHA512
7b5e8c5133718833bc0b46ae9cd207bf5a5feae625aada7f8f3ba8b2955e822807181c67d297e2e14fc6f47c0edac602a5226fae90d2e6cc9dee8bfab8b84496
-
SSDEEP
24576:jgLPBR6ai3HxEqnNgAB9z1mDLNOCuaDA0V8xPE7yJXn8Byh:iROHL1mDACuaDA2wLM
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b64b9829be04d3651f1ff1fab7aa51dc_JaffaCakes118.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine b64b9829be04d3651f1ff1fab7aa51dc_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/4216-0-0x0000000000400000-0x00000000006A9000-memory.dmp upx behavioral2/memory/4216-2-0x0000000000400000-0x00000000006A9000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4216 b64b9829be04d3651f1ff1fab7aa51dc_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b64b9829be04d3651f1ff1fab7aa51dc_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4216 b64b9829be04d3651f1ff1fab7aa51dc_JaffaCakes118.exe 4216 b64b9829be04d3651f1ff1fab7aa51dc_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b64b9829be04d3651f1ff1fab7aa51dc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b64b9829be04d3651f1ff1fab7aa51dc_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2708,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:81⤵PID:5056