Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 19:27
Static task
static1
Behavioral task
behavioral1
Sample
bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe
-
Size
84KB
-
MD5
bce1c4eab4cc9dc82cce0f360ce22edb
-
SHA1
15ea0e6a88f2c1979dd3d6f135f4591031baf639
-
SHA256
f2910adb30a6f61cbc56141f8625c1ec46ba631e6856616f716ca0e390beb824
-
SHA512
73f4b7a1bc8e3153baa10a60cdbd3231f977c082f000a980f73c9d2334c96882b73c238eea8c84a35fc570ab372c70db6d0a5017c7c36b8b2c1616db2ed5e80b
-
SSDEEP
1536:9uJAbqy3Zoz21uNfuiLOeWGNOJ6IDo5gkR4GxoRZsQvo2t:9AtypoU2LORGNOhKgkRP2t
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\CmSTP = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmstp.exe /waitservice" bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Esent Utl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\esentutl.exe /waitservice" bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1552 rsvp.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rsvp.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ComRepl = "C:\\Users\\Admin\\LOCALS~1\\APPLIC~1\\MICROS~1\\comrepl.exe /waitservice" bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3208 wrote to memory of 1552 3208 bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe 84 PID 3208 wrote to memory of 1552 3208 bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe 84 PID 3208 wrote to memory of 1552 3208 bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\rsvp.exeC:\Users\Admin\AppData\Local\Temp\rsvp.exe /waitservice2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5bce1c4eab4cc9dc82cce0f360ce22edb
SHA115ea0e6a88f2c1979dd3d6f135f4591031baf639
SHA256f2910adb30a6f61cbc56141f8625c1ec46ba631e6856616f716ca0e390beb824
SHA51273f4b7a1bc8e3153baa10a60cdbd3231f977c082f000a980f73c9d2334c96882b73c238eea8c84a35fc570ab372c70db6d0a5017c7c36b8b2c1616db2ed5e80b