Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 22:29
Static task
static1
Behavioral task
behavioral1
Sample
bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe
-
Size
212KB
-
MD5
bd69efedb60ab5d7f682c26192ff4b44
-
SHA1
64cb100fcd6a10b5b757bc7d5dc515afb05ebfbf
-
SHA256
91f2b7ff458c075f460ca4ba350c6547f1f71e723ec0dec1a267ef8ddd793930
-
SHA512
01fde22e7b6a836eae533fd011a1c93274d9411ad16a7b0589a21022140ce25745dd537b3f0a21c988b7acaf8215792a4e0e6cc8ccd3e0881d3b3575ef39afec
-
SSDEEP
3072:Kgryo0EWRHcJY66+cwJfs5cDaqXwqhYZ4z1sxtbjIUWnoRzs:1c9z0aqaqXEZ4zytbL4
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4312 bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\explorer.exe.local bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe File created C:\Windows\ws2help.dll bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe File opened for modification C:\Windows\ws2help.dll bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe File created C:\Windows\Wplugin.dll bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe File opened for modification C:\Windows\Wplugin.dll bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe -
Hijack Execution Flow: DLL Search Order Hijacking 1 TTPs
Possible initial access via DLL redirection search order hijacking.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4312 bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe 4312 bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4312 bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd69efedb60ab5d7f682c26192ff4b44_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4312
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD58847a8302dacc1d6fca61f125c8fe8e0
SHA1f399142bbf03660bee1df555ebbf3acc8f658cf0
SHA2569c2726defa122089f8251fa104f76d66830f448774ab9bd634adbb6e492e3943
SHA5122b028bb4139c352b80db1509d1a3f479a8ef7e9b3b73ddbf62e2d83d4e59adf4a0bd6b9d68409bc0b6fafb7a5f56844fbfed6d00b824a6b370689801ce1c837f