Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 12:16
Behavioral task
behavioral1
Sample
c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
General
-
Target
c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe
-
Size
275KB
-
MD5
c8ccd2a3b2a0fd007acfaa2702d77282
-
SHA1
2fa4b411d1f169d85365441857e3b4954c620d92
-
SHA256
182564a4a0bcd10067790bca10403afe1513ef3a5557b78d3122546a71ecde7c
-
SHA512
cd11bcccb2a42096f51a73221308900fd1f03cdd297c782866d031c38728b7af95d12940aa33f2e8f28a82f005e12495358cad79ef91c843c0787e8899bda8d4
-
SSDEEP
6144:b+yAvdzGsBjS7qErcJG+M+Ca3a6PjHEvJjPuqmvYH2zn2USZ4ab1C:F23lCqErck+MirjHQJzuRvYWzdSKsg
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/392-0-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/392-7-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/392-8-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/392-9-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/392-10-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/392-11-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/392-12-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/392-13-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/392-14-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/392-15-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\s: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\v: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\a: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\l: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\m: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\h: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\j: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\o: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\q: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\t: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\u: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\x: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\y: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\g: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\e: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\i: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\k: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\n: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\r: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\w: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\z: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe File opened (read-only) \??\b: c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/392-7-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/392-8-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/392-9-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/392-10-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/392-11-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/392-12-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/392-13-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/392-14-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/392-15-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe 392 c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c8ccd2a3b2a0fd007acfaa2702d77282_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:392