Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 07:25
Static task
static1
Behavioral task
behavioral1
Sample
bad48b59a32db64e9b8dd79535c55082_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bad48b59a32db64e9b8dd79535c55082_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bad48b59a32db64e9b8dd79535c55082_JaffaCakes118.exe
-
Size
224KB
-
MD5
bad48b59a32db64e9b8dd79535c55082
-
SHA1
0e4ca7c9976d476cb3fe6fbd895c02272897826e
-
SHA256
241c00ff76494c9143dfe5080cbfb3ed04328db117f654ec9d944336c0e7cbaa
-
SHA512
58a6be6dfdaa54db537d8f0838f6fb8c6157cdd66e03b40132998f906843e89bc6de8fd8313af4262feb43fcfc34a8b153a088bd10d8e4081b4718189e904587
-
SSDEEP
3072:osQpNupVCso5g0GPfV/FRC/B0khVE/50mitp5kmbwCW1CZudFVyX5:aqv7PkhVE/+RH5vwCAAuDV
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation bad48b59a32db64e9b8dd79535c55082_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4192 fytme.exe -
Loads dropped DLL 1 IoCs
pid Process 4192 fytme.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 15 IoCs
pid pid_target Process procid_target 2596 1336 WerFault.exe 83 4092 1336 WerFault.exe 83 3048 1336 WerFault.exe 83 440 1336 WerFault.exe 83 3768 1336 WerFault.exe 83 1352 1336 WerFault.exe 83 4128 1336 WerFault.exe 83 4396 1336 WerFault.exe 83 4344 4192 WerFault.exe 113 3316 4192 WerFault.exe 113 4752 4192 WerFault.exe 113 1920 4192 WerFault.exe 113 1608 4192 WerFault.exe 113 1336 4192 WerFault.exe 113 4980 4192 WerFault.exe 113 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bad48b59a32db64e9b8dd79535c55082_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fytme.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4628 cmd.exe 4388 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 1968 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4388 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4192 fytme.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1968 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4192 fytme.exe 4192 fytme.exe 4192 fytme.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4192 fytme.exe 4192 fytme.exe 4192 fytme.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1336 wrote to memory of 4628 1336 bad48b59a32db64e9b8dd79535c55082_JaffaCakes118.exe 107 PID 1336 wrote to memory of 4628 1336 bad48b59a32db64e9b8dd79535c55082_JaffaCakes118.exe 107 PID 1336 wrote to memory of 4628 1336 bad48b59a32db64e9b8dd79535c55082_JaffaCakes118.exe 107 PID 4628 wrote to memory of 1968 4628 cmd.exe 110 PID 4628 wrote to memory of 1968 4628 cmd.exe 110 PID 4628 wrote to memory of 1968 4628 cmd.exe 110 PID 4628 wrote to memory of 4388 4628 cmd.exe 112 PID 4628 wrote to memory of 4388 4628 cmd.exe 112 PID 4628 wrote to memory of 4388 4628 cmd.exe 112 PID 4628 wrote to memory of 4192 4628 cmd.exe 113 PID 4628 wrote to memory of 4192 4628 cmd.exe 113 PID 4628 wrote to memory of 4192 4628 cmd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\bad48b59a32db64e9b8dd79535c55082_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bad48b59a32db64e9b8dd79535c55082_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 6482⤵
- Program crash
PID:2596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 7522⤵
- Program crash
PID:4092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 8682⤵
- Program crash
PID:3048
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 7722⤵
- Program crash
PID:440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 7562⤵
- Program crash
PID:3768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 10122⤵
- Program crash
PID:1352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 10482⤵
- Program crash
PID:4128
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1336 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\bad48b59a32db64e9b8dd79535c55082_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\fytme.exe -f2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 13363⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4388
-
-
C:\Users\Admin\AppData\Local\fytme.exeC:\Users\Admin\AppData\Local\fytme.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4192 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 8324⤵
- Program crash
PID:4344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 8804⤵
- Program crash
PID:3316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 11804⤵
- Program crash
PID:4752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 12204⤵
- Program crash
PID:1920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 11884⤵
- Program crash
PID:1608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 12284⤵
- Program crash
PID:1336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 11084⤵
- Program crash
PID:4980
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 1522⤵
- Program crash
PID:4396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1336 -ip 13361⤵PID:4244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1336 -ip 13361⤵PID:4348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1336 -ip 13361⤵PID:4632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1336 -ip 13361⤵PID:2176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1336 -ip 13361⤵PID:2468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1336 -ip 13361⤵PID:972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1336 -ip 13361⤵PID:4048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1336 -ip 13361⤵PID:3576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4192 -ip 41921⤵PID:1640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4192 -ip 41921⤵PID:1000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4192 -ip 41921⤵PID:3060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4192 -ip 41921⤵PID:3356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4192 -ip 41921⤵PID:2132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4192 -ip 41921⤵PID:2296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4192 -ip 41921⤵PID:1860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD5bad48b59a32db64e9b8dd79535c55082
SHA10e4ca7c9976d476cb3fe6fbd895c02272897826e
SHA256241c00ff76494c9143dfe5080cbfb3ed04328db117f654ec9d944336c0e7cbaa
SHA51258a6be6dfdaa54db537d8f0838f6fb8c6157cdd66e03b40132998f906843e89bc6de8fd8313af4262feb43fcfc34a8b153a088bd10d8e4081b4718189e904587