Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 02:07
Behavioral task
behavioral1
Sample
ce677d98a5f5b88b3745c72a81162f57_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ce677d98a5f5b88b3745c72a81162f57_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ce677d98a5f5b88b3745c72a81162f57_JaffaCakes118.exe
-
Size
169KB
-
MD5
ce677d98a5f5b88b3745c72a81162f57
-
SHA1
3413bf08231af30cdc1befff5867abcd1ce97757
-
SHA256
8cb5d2a5d22bdc82d3619ec0fde0e19cb8ba4e7f6488935b65e69619d86c5201
-
SHA512
e623fd13ea68568ce79c0ac215a3682cbfcb330b9c82bb76a3d183f004b11e687c128c00ba0a37a9603c39c68e448ec02f9567afbe75f3f6a6ff32a10677b21c
-
SSDEEP
3072:4B8abHKaE+xKyG88RDdUMzCOuMHzm9z1cxeEG3iVB0EYK/o4UQ/GKODBz3yRa0:4B8aGDqKyb4Jdzry9zkeEmiVB0c/rUga
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3668 SPYNET~2.EXE 876 SPYNET~2.EXE -
resource yara_rule behavioral2/files/0x000900000002360e-4.dat upx behavioral2/memory/3668-5-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/3668-7-0x0000000010410000-0x0000000010445000-memory.dmp upx behavioral2/memory/3668-13-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/3668-14-0x0000000010450000-0x0000000010485000-memory.dmp upx behavioral2/memory/876-64-0x0000000010450000-0x0000000010485000-memory.dmp upx behavioral2/memory/876-67-0x0000000010450000-0x0000000010485000-memory.dmp upx behavioral2/memory/3668-66-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/3668-60-0x0000000010450000-0x0000000010485000-memory.dmp upx behavioral2/memory/876-76-0x0000000010450000-0x0000000010485000-memory.dmp upx behavioral2/memory/876-75-0x0000000010450000-0x0000000010485000-memory.dmp upx behavioral2/memory/876-77-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/876-79-0x0000000010450000-0x0000000010485000-memory.dmp upx -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ce677d98a5f5b88b3745c72a81162f57_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\-Net = "C:\\Windows\\system32\\soos\\system0.exe" SPYNET~2.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\-Net = "C:\\Windows\\system32\\soos\\system0.exe" SPYNET~2.EXE -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\soos\system0.exe SPYNET~2.EXE File opened for modification C:\Windows\SysWOW64\soos\system0.exe SPYNET~2.EXE File opened for modification C:\Windows\SysWOW64\soos\plugin.dat SPYNET~2.EXE File created C:\Windows\SysWOW64\soos\logs.dat SPYNET~2.EXE File opened for modification C:\Windows\SysWOW64\soos\logs.dat SPYNET~2.EXE -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ce677d98a5f5b88b3745c72a81162f57_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPYNET~2.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPYNET~2.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3668 SPYNET~2.EXE 3668 SPYNET~2.EXE 3668 SPYNET~2.EXE 3668 SPYNET~2.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 876 SPYNET~2.EXE -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3668 SPYNET~2.EXE Token: SeDebugPrivilege 3668 SPYNET~2.EXE Token: SeDebugPrivilege 3668 SPYNET~2.EXE Token: SeDebugPrivilege 3668 SPYNET~2.EXE Token: SeDebugPrivilege 876 SPYNET~2.EXE Token: SeDebugPrivilege 876 SPYNET~2.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5684 wrote to memory of 3668 5684 ce677d98a5f5b88b3745c72a81162f57_JaffaCakes118.exe 92 PID 5684 wrote to memory of 3668 5684 ce677d98a5f5b88b3745c72a81162f57_JaffaCakes118.exe 92 PID 5684 wrote to memory of 3668 5684 ce677d98a5f5b88b3745c72a81162f57_JaffaCakes118.exe 92 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96 PID 3668 wrote to memory of 4140 3668 SPYNET~2.EXE 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce677d98a5f5b88b3745c72a81162f57_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ce677d98a5f5b88b3745c72a81162f57_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SPYNET~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SPYNET~2.EXE2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:4140
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SPYNET~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SPYNET~2.EXE3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:876
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4384,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:81⤵PID:1968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5ef0cc6a38a0841b34f02df8eecab9546
SHA1bbd630ae8342c22c2f125997eb43cfc3ad0e65ea
SHA2566bc98105a007ac0d46f526a961e2a823319c328476f29bf6c834ffa85a70e6f5
SHA512ca3dcef329bfbd19945bf48b57b9d05fa23e764cd2ba59e4322b19c456596cd6f9cf03cc564c3e0339fcbfa8dbbce3521333609d1d30eb88d600556e9c2be6bc