Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 22:11
Static task
static1
Behavioral task
behavioral1
Sample
d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe
-
Size
316KB
-
MD5
d08c99680c39b203dbd8d56444dc1bf2
-
SHA1
85fdebc1ee8522910e2f69da740d177417a2f3ca
-
SHA256
4832eb3519ae1800a33f4b682c6d3b621a98ada0e92d137deac44348552fd8dd
-
SHA512
9dd3e877d30e593ec64993be227a31b0fcbddcfe3ca98b79d7cb9dc70b19ae8a456fd438ef0a5e4e00718e68438c3bf800da7c54efc2b8eb8092c6e2bca0b4d4
-
SSDEEP
6144:l8BmLHC9+7SxhjmqsfGCIUZXiwRlDzgnJOGHhZ9al5YgvysriJOh:l6h5mf3I2iwDzgn3Y5h6sriJ2
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1724 lIpCnBg18700.exe -
Executes dropped EXE 1 IoCs
pid Process 1724 lIpCnBg18700.exe -
resource yara_rule behavioral2/memory/2704-2-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2704-3-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2704-6-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2704-5-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/1724-19-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2704-23-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/1724-25-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/1724-33-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2704-44-0x0000000000400000-0x00000000004B3000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lIpCnBg18700 = "C:\\ProgramData\\lIpCnBg18700\\lIpCnBg18700.exe" lIpCnBg18700.exe -
Program crash 28 IoCs
pid pid_target Process procid_target 4952 2704 WerFault.exe 82 4188 2704 WerFault.exe 82 1700 2704 WerFault.exe 82 2992 1724 WerFault.exe 89 2120 2704 WerFault.exe 82 3700 1724 WerFault.exe 89 3380 2704 WerFault.exe 82 2176 1724 WerFault.exe 89 1876 2704 WerFault.exe 82 3804 1724 WerFault.exe 89 2852 2704 WerFault.exe 82 4548 1724 WerFault.exe 89 760 2704 WerFault.exe 82 1052 1724 WerFault.exe 89 5004 2704 WerFault.exe 82 892 1724 WerFault.exe 89 1436 1724 WerFault.exe 89 3144 1724 WerFault.exe 89 1556 1724 WerFault.exe 89 3400 1724 WerFault.exe 89 3856 1724 WerFault.exe 89 2928 1724 WerFault.exe 89 2952 1724 WerFault.exe 89 1680 1724 WerFault.exe 89 2716 2704 WerFault.exe 82 4120 2704 WerFault.exe 82 560 1724 WerFault.exe 89 3184 1724 WerFault.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lIpCnBg18700.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 1724 lIpCnBg18700.exe 1724 lIpCnBg18700.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 1724 lIpCnBg18700.exe 1724 lIpCnBg18700.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 1724 lIpCnBg18700.exe 1724 lIpCnBg18700.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 1724 lIpCnBg18700.exe 1724 lIpCnBg18700.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 1724 lIpCnBg18700.exe 1724 lIpCnBg18700.exe 1724 lIpCnBg18700.exe 1724 lIpCnBg18700.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 1724 lIpCnBg18700.exe 1724 lIpCnBg18700.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 1724 lIpCnBg18700.exe 1724 lIpCnBg18700.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 1724 lIpCnBg18700.exe 1724 lIpCnBg18700.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe Token: SeDebugPrivilege 1724 lIpCnBg18700.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1724 lIpCnBg18700.exe 1724 lIpCnBg18700.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1724 lIpCnBg18700.exe 1724 lIpCnBg18700.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1724 lIpCnBg18700.exe 1724 lIpCnBg18700.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2704 wrote to memory of 1724 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 89 PID 2704 wrote to memory of 1724 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 89 PID 2704 wrote to memory of 1724 2704 d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 5642⤵
- Program crash
PID:4952
-
-
C:\ProgramData\lIpCnBg18700\lIpCnBg18700.exe"C:\ProgramData\lIpCnBg18700\lIpCnBg18700.exe" "C:\Users\Admin\AppData\Local\Temp\d08c99680c39b203dbd8d56444dc1bf2_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1724 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 7363⤵
- Program crash
PID:2992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 7443⤵
- Program crash
PID:3700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 8043⤵
- Program crash
PID:2176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 8203⤵
- Program crash
PID:3804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 8283⤵
- Program crash
PID:4548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 9843⤵
- Program crash
PID:1052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 10323⤵
- Program crash
PID:892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 12043⤵
- Program crash
PID:1436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 14083⤵
- Program crash
PID:3144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 16043⤵
- Program crash
PID:1556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 6443⤵
- Program crash
PID:3400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 15963⤵
- Program crash
PID:3856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 16163⤵
- Program crash
PID:2928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 17923⤵
- Program crash
PID:2952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 18003⤵
- Program crash
PID:1680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 7563⤵
- Program crash
PID:560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 7923⤵
- Program crash
PID:3184
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 6242⤵
- Program crash
PID:4188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 8002⤵
- Program crash
PID:1700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 8002⤵
- Program crash
PID:2120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 8482⤵
- Program crash
PID:3380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 8562⤵
- Program crash
PID:1876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 9562⤵
- Program crash
PID:2852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 10322⤵
- Program crash
PID:760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 12042⤵
- Program crash
PID:5004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 6482⤵
- Program crash
PID:2716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 1402⤵
- Program crash
PID:4120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2704 -ip 27041⤵PID:1040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2704 -ip 27041⤵PID:3636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2704 -ip 27041⤵PID:3208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1724 -ip 17241⤵PID:4900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2704 -ip 27041⤵PID:2788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1724 -ip 17241⤵PID:4928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2704 -ip 27041⤵PID:1956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1724 -ip 17241⤵PID:1364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2704 -ip 27041⤵PID:1692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1724 -ip 17241⤵PID:4368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2704 -ip 27041⤵PID:4360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1724 -ip 17241⤵PID:3460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2704 -ip 27041⤵PID:2204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1724 -ip 17241⤵PID:4860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2704 -ip 27041⤵PID:2752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1724 -ip 17241⤵PID:2080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1724 -ip 17241⤵PID:3304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1724 -ip 17241⤵PID:1984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 1724 -ip 17241⤵PID:4436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1724 -ip 17241⤵PID:3208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1724 -ip 17241⤵PID:4900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1724 -ip 17241⤵PID:3148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 1724 -ip 17241⤵PID:1844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1724 -ip 17241⤵PID:5020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 2704 -ip 27041⤵PID:1612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2704 -ip 27041⤵PID:2276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1724 -ip 17241⤵PID:880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 1724 -ip 17241⤵PID:928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
316KB
MD5aaa1c779e78781902c10950e652daec4
SHA1388ae994e6e7f24e3d2353c209fa562c0cbc83b4
SHA256f772badf7596d20e8cc297b503c1ae6ce468af0c8ae487cc5c10679e5532c578
SHA512b29d9598f3dfac5634866b7a8303de95fc0af6f7f868be8d62b8942440cda038d23a57e5ab4dbcae816cee05ff7659e1cd9e05af7e8f0943bf48bb2682600fa2