Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 04:11
Static task
static1
Behavioral task
behavioral1
Sample
ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe
-
Size
461KB
-
MD5
ba4e976af6663bff40803711fd89230a
-
SHA1
303b0789c69e9bd69a10178563a37d0d750aba0e
-
SHA256
d5b3ee6b5b5f4047ccb94d6f7f6477c9b6efaa40ec24db658a42d44e706e4b3c
-
SHA512
dabaaf59a7dc4c195042737a74a2b3356d56d86597dd7ba712b72766b0dde1e95f0362077bca7b9075e56ab426c2fbe7d094820dd493d0720034a92b92cf5649
-
SSDEEP
12288:Fvs//PBjZn0D/Mo/ukOH9MryRsqZn/qskGHqWFBkl:F0/xVn0DBWkOHSrmwWqr
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2740 eG01850HhClM01850.exe -
Executes dropped EXE 1 IoCs
pid Process 2740 eG01850HhClM01850.exe -
Loads dropped DLL 2 IoCs
pid Process 2304 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe 2304 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2304-19-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/2304-18-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2304-2-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2740-31-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2740-41-0x0000000000400000-0x00000000004C4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eG01850HhClM01850 = "C:\\ProgramData\\eG01850HhClM01850\\eG01850HhClM01850.exe" eG01850HhClM01850.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eG01850HhClM01850.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main eG01850HhClM01850.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2304 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2304 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe Token: SeDebugPrivilege 2740 eG01850HhClM01850.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2740 eG01850HhClM01850.exe 2740 eG01850HhClM01850.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2740 2304 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe 30 PID 2304 wrote to memory of 2740 2304 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe 30 PID 2304 wrote to memory of 2740 2304 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe 30 PID 2304 wrote to memory of 2740 2304 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\ProgramData\eG01850HhClM01850\eG01850HhClM01850.exe"C:\ProgramData\eG01850HhClM01850\eG01850HhClM01850.exe" "C:\Users\Admin\AppData\Local\Temp\ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
461KB
MD5ead71fb404a1a27d4314719ba22e6afb
SHA14c398d9d7d969461a86359f8976f3f1f96f30dbe
SHA25653158972177a8712807542b4b97489c20e735d5ad16aa83e890ced6819a00e80
SHA512df297234d94421d3a9428a654183a118189816a89f50da4802c05b319e23bc6efb6439631097646e7e35f6c5f73ed16d27ad9fe895139bf1558fec83d2652a6c