Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 04:11
Static task
static1
Behavioral task
behavioral1
Sample
ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe
-
Size
461KB
-
MD5
ba4e976af6663bff40803711fd89230a
-
SHA1
303b0789c69e9bd69a10178563a37d0d750aba0e
-
SHA256
d5b3ee6b5b5f4047ccb94d6f7f6477c9b6efaa40ec24db658a42d44e706e4b3c
-
SHA512
dabaaf59a7dc4c195042737a74a2b3356d56d86597dd7ba712b72766b0dde1e95f0362077bca7b9075e56ab426c2fbe7d094820dd493d0720034a92b92cf5649
-
SSDEEP
12288:Fvs//PBjZn0D/Mo/ukOH9MryRsqZn/qskGHqWFBkl:F0/xVn0DBWkOHSrmwWqr
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 752 cD01850OlGfB01850.exe -
Executes dropped EXE 1 IoCs
pid Process 752 cD01850OlGfB01850.exe -
resource yara_rule behavioral2/memory/3464-2-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3464-14-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3464-15-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/752-25-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/752-33-0x0000000000400000-0x00000000004C4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cD01850OlGfB01850 = "C:\\ProgramData\\cD01850OlGfB01850\\cD01850OlGfB01850.exe" cD01850OlGfB01850.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cD01850OlGfB01850.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3464 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe 3464 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3464 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe Token: SeDebugPrivilege 752 cD01850OlGfB01850.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 752 cD01850OlGfB01850.exe 752 cD01850OlGfB01850.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3464 wrote to memory of 752 3464 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe 94 PID 3464 wrote to memory of 752 3464 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe 94 PID 3464 wrote to memory of 752 3464 ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\ProgramData\cD01850OlGfB01850\cD01850OlGfB01850.exe"C:\ProgramData\cD01850OlGfB01850\cD01850OlGfB01850.exe" "C:\Users\Admin\AppData\Local\Temp\ba4e976af6663bff40803711fd89230a_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4180,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:81⤵PID:3884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
461KB
MD598b84efafbb480bf5b047ad1c44d6c68
SHA18d4aeccf12a9e56a53e6097ba6b669c1bbd2ad16
SHA25695626844b506d49a158b4860b8cfdbdb504f57abca145bcb69ff640b5d7fb3e7
SHA51224a557430e84ba268f50b7c91e9d27b2b703e7b36507659e59e71d792eac9d4678fbfa6e3777fb0b4b1b3132c8f98f20689c804679c5e99302a2850b35c48da4