Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 08:54
Static task
static1
Behavioral task
behavioral1
Sample
cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe
-
Size
348KB
-
MD5
cf28f3d39fd78d020df13df413696d19
-
SHA1
4f4a343ef2e46481183795b3b2c6a3a1a0f65e20
-
SHA256
47d6addd48e4d3075d98ef0852591dc95020f76355a437622c0598a2767dd81c
-
SHA512
68672ca7402bddff708656a34d34514dcbc06656dc1413307beaa6e635ff0ea89967c28237427eea1d51040b8c7add86c5c575136b2020aedaba178ac70e3904
-
SSDEEP
6144:jf88mV0bMZUby0d33/UsfV166Q8YEy6mCegOXRcVjSTVA1lLMF:DbU0bMuR3BfjXBNYgOX6VWTqfoF
Malware Config
Signatures
-
Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State = "146944" Rq8wfyOY.exe -
resource yara_rule behavioral2/memory/4528-1-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/3196-3-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral2/memory/3196-5-0x0000000000400000-0x00000000004D8000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Rq8wfyOY Rq8wfyOY.exe File opened for modification C:\PROGRA~3\Rq8wfyOY Rq8wfyOY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Rq8wfyOY.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main Rq8wfyOY.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" Rq8wfyOY.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4528 cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3196 Rq8wfyOY.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4528 cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe 3196 Rq8wfyOY.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4528 wrote to memory of 3196 4528 cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe 88 PID 4528 wrote to memory of 3196 4528 cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe 88 PID 4528 wrote to memory of 3196 4528 cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\PROGRA~3\Rq8wfyOY.exeC:\PROGRA~3\Rq8wfyOY.exe2⤵
- Manipulates Digital Signatures
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3196
-