Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe
-
Size
184KB
-
MD5
c0bfb02720abf1e414d46f11615046ed
-
SHA1
abb6c013764c1e5a31f5f60f3cc5c8efecb3cd2c
-
SHA256
c1f859a6becc81791ebbc089436e6b454229a170df9ccc2eae18772cfbabd487
-
SHA512
6c6933faf71c0a5bcbd0cb1ecba6a5734ceb26e7f710d7aff2c59718a0b7f041b0c6e1ecca8a33ead3775ff9bda125485340de12b0a7273ada1cf81d9ab71516
-
SSDEEP
3072:BO++vq4Wf4lFV3x62HHJ0OYAbO6LDxpsaFjBmReqxkAdsxYYY9Yq7:0+yqdf4bl/Hp0obtJ1kAKC
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95529770-2F2v-220Y-2vE0-YY39E9G9221}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\javaw.exe" c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{95529770-2F2v-220Y-2vE0-YY39E9G9221} c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4908 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4908 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1524 c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe 1524 c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe 1524 c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe 1524 c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1524 c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1524 c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1524 wrote to memory of 4676 1524 c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe 94 PID 1524 wrote to memory of 4676 1524 c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe 94 PID 1524 wrote to memory of 4676 1524 c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe 94 PID 4676 wrote to memory of 4908 4676 cmd.exe 96 PID 4676 wrote to memory of 4908 4676 cmd.exe 96 PID 4676 wrote to memory of 4908 4676 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c0bfb02720abf1e414d46f11615046ed_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 103⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4908
-
-