Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe
-
Size
130KB
-
MD5
c980a5632fdf0ce9dacd2285c1f73fef
-
SHA1
b6a76d0246bc2217a9f35bbe8f147d99c54fbecf
-
SHA256
0958311cdbc72029fff008692d4d344bcbfa6df469f3181309b93cd1429ce8d6
-
SHA512
8ccf64420f6f63528caef9a5554b20aa6c15cda7e5f18eea9814c0b8966af504f6d272f0d44c5416f718013e3953e1b417a90447ac7bd58de6e7e94f5a1e3e13
-
SSDEEP
3072:IsY8JPMTtmi0vZemB0taM5Gmjck0huCP3F:PGc9smesY4kjC/F
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
resource yara_rule behavioral2/memory/4872-2-0x0000000010000000-0x0000000010037000-memory.dmp family_gh0strat behavioral2/memory/4872-6-0x0000000010000000-0x0000000010037000-memory.dmp family_gh0strat behavioral2/memory/4872-5-0x0000000010000000-0x0000000010037000-memory.dmp family_gh0strat behavioral2/memory/4872-4-0x0000000010000000-0x0000000010037000-memory.dmp family_gh0strat behavioral2/memory/4872-12-0x0000000010000000-0x0000000010037000-memory.dmp family_gh0strat -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XXXXXXEB5143C5 = "C:\\Windows\\XXXXXXEB5143C5\\svchsot.exe" c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Default c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\XXXXXXEB5143C5\JH.BAT c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3236 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 31 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe -
System Service Discovery 1 TTPs 2 IoCs
Adversaries may try to gather information about registered local system services.
pid Process 2544 net.exe 3704 net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4872 c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe 4872 c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe 4872 c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe 4872 c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe 4872 c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe 4872 c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe 4872 c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe 4872 c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4872 c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4872 wrote to memory of 3132 4872 c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe 87 PID 4872 wrote to memory of 3132 4872 c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe 87 PID 4872 wrote to memory of 3132 4872 c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe 87 PID 3132 wrote to memory of 3504 3132 cmd.exe 89 PID 3132 wrote to memory of 3504 3132 cmd.exe 89 PID 3132 wrote to memory of 3504 3132 cmd.exe 89 PID 3132 wrote to memory of 3236 3132 cmd.exe 91 PID 3132 wrote to memory of 3236 3132 cmd.exe 91 PID 3132 wrote to memory of 3236 3132 cmd.exe 91 PID 3132 wrote to memory of 2544 3132 cmd.exe 92 PID 3132 wrote to memory of 2544 3132 cmd.exe 92 PID 3132 wrote to memory of 2544 3132 cmd.exe 92 PID 2544 wrote to memory of 3704 2544 net.exe 93 PID 2544 wrote to memory of 3704 2544 net.exe 93 PID 2544 wrote to memory of 3704 2544 net.exe 93 PID 3132 wrote to memory of 4600 3132 cmd.exe 94 PID 3132 wrote to memory of 4600 3132 cmd.exe 94 PID 3132 wrote to memory of 4600 3132 cmd.exe 94 PID 3132 wrote to memory of 4028 3132 cmd.exe 95 PID 3132 wrote to memory of 4028 3132 cmd.exe 95 PID 3132 wrote to memory of 4028 3132 cmd.exe 95 PID 3132 wrote to memory of 4048 3132 cmd.exe 97 PID 3132 wrote to memory of 4048 3132 cmd.exe 97 PID 3132 wrote to memory of 4048 3132 cmd.exe 97 PID 3132 wrote to memory of 4444 3132 cmd.exe 98 PID 3132 wrote to memory of 4444 3132 cmd.exe 98 PID 3132 wrote to memory of 4444 3132 cmd.exe 98 PID 3132 wrote to memory of 2088 3132 cmd.exe 99 PID 3132 wrote to memory of 2088 3132 cmd.exe 99 PID 3132 wrote to memory of 2088 3132 cmd.exe 99 PID 3132 wrote to memory of 2612 3132 cmd.exe 100 PID 3132 wrote to memory of 2612 3132 cmd.exe 100 PID 3132 wrote to memory of 2612 3132 cmd.exe 100 PID 3132 wrote to memory of 3420 3132 cmd.exe 101 PID 3132 wrote to memory of 3420 3132 cmd.exe 101 PID 3132 wrote to memory of 3420 3132 cmd.exe 101 PID 3132 wrote to memory of 3136 3132 cmd.exe 102 PID 3132 wrote to memory of 3136 3132 cmd.exe 102 PID 3132 wrote to memory of 3136 3132 cmd.exe 102 PID 3132 wrote to memory of 1320 3132 cmd.exe 103 PID 3132 wrote to memory of 1320 3132 cmd.exe 103 PID 3132 wrote to memory of 1320 3132 cmd.exe 103 PID 3132 wrote to memory of 2236 3132 cmd.exe 104 PID 3132 wrote to memory of 2236 3132 cmd.exe 104 PID 3132 wrote to memory of 2236 3132 cmd.exe 104 PID 3132 wrote to memory of 320 3132 cmd.exe 105 PID 3132 wrote to memory of 320 3132 cmd.exe 105 PID 3132 wrote to memory of 320 3132 cmd.exe 105 PID 3132 wrote to memory of 4436 3132 cmd.exe 107 PID 3132 wrote to memory of 4436 3132 cmd.exe 107 PID 3132 wrote to memory of 4436 3132 cmd.exe 107 PID 3132 wrote to memory of 3412 3132 cmd.exe 108 PID 3132 wrote to memory of 3412 3132 cmd.exe 108 PID 3132 wrote to memory of 3412 3132 cmd.exe 108 PID 3132 wrote to memory of 1368 3132 cmd.exe 109 PID 3132 wrote to memory of 1368 3132 cmd.exe 109 PID 3132 wrote to memory of 1368 3132 cmd.exe 109 PID 3132 wrote to memory of 1728 3132 cmd.exe 110 PID 3132 wrote to memory of 1728 3132 cmd.exe 110 PID 3132 wrote to memory of 1728 3132 cmd.exe 110 PID 3132 wrote to memory of 4056 3132 cmd.exe 112 PID 3132 wrote to memory of 4056 3132 cmd.exe 112 PID 3132 wrote to memory of 4056 3132 cmd.exe 112 PID 3132 wrote to memory of 4580 3132 cmd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\XXXXXXEB5143C5\JH.BAT2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f3⤵
- System Location Discovery: System Language Discovery
PID:3504
-
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= auto3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3236
-
-
C:\Windows\SysWOW64\net.exenet start "Task Scheduler"3⤵
- System Location Discovery: System Language Discovery
- System Service Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start "Task Scheduler"4⤵
- System Location Discovery: System Language Discovery
- System Service Discovery
PID:3704
-
-
-
C:\Windows\SysWOW64\at.exeAt 0:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:4600
-
-
C:\Windows\SysWOW64\at.exeAt 1:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:4028
-
-
C:\Windows\SysWOW64\at.exeAt 2:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:4048
-
-
C:\Windows\SysWOW64\at.exeAt 3:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:4444
-
-
C:\Windows\SysWOW64\at.exeAt 4:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2088
-
-
C:\Windows\SysWOW64\at.exeAt 5:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2612
-
-
C:\Windows\SysWOW64\at.exeAt 6:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:3420
-
-
C:\Windows\SysWOW64\at.exeAt 7:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:3136
-
-
C:\Windows\SysWOW64\at.exeAt 8:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:1320
-
-
C:\Windows\SysWOW64\at.exeAt 9:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2236
-
-
C:\Windows\SysWOW64\at.exeAt 10:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:320
-
-
C:\Windows\SysWOW64\at.exeAt 11:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:4436
-
-
C:\Windows\SysWOW64\at.exeAt 12:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:3412
-
-
C:\Windows\SysWOW64\at.exeAt 13:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:1368
-
-
C:\Windows\SysWOW64\at.exeAt 14:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:1728
-
-
C:\Windows\SysWOW64\at.exeAt 15:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:4056
-
-
C:\Windows\SysWOW64\at.exeAt 16:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:4580
-
-
C:\Windows\SysWOW64\at.exeAt 17:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:536
-
-
C:\Windows\SysWOW64\at.exeAt 18:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:5100
-
-
C:\Windows\SysWOW64\at.exeAt 19:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:4356
-
-
C:\Windows\SysWOW64\at.exeAt 20:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:3960
-
-
C:\Windows\SysWOW64\at.exeAt 21:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:3448
-
-
C:\Windows\SysWOW64\at.exeAt 22:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2096
-
-
C:\Windows\SysWOW64\at.exeAt 23:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2920
-
-
C:\Windows\SysWOW64\at.exeAt 24:00 C:\Windows\XXXXXXEB5143C5\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:4596
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c54d8baadee680bc3812d710c4412e76
SHA139549bd634d0b15759cf093f059d92a5178b7d51
SHA25636a87ed67841e950e60efc232d32312bddfefa869ed23033bb0dd5bf92cd49bb
SHA5125bf3e87cac21d804fa3a9db2c3ba4a309ac0d9a4a8c404ec607e81823c564d4301cd9e5460eab39f6ce3aaa2827e80e7afa081b267a67d99b59a219a90ed4859