Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 22:45
Static task
static1
Behavioral task
behavioral1
Sample
d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe
-
Size
168KB
-
MD5
d2fd718b7af52fecb60dc352cad16741
-
SHA1
e2e1086ff9080bfb748f17745721a3ce3f28dcd5
-
SHA256
0bf0548c2b9d4dbc4be0b3056393c71028108ea2b66cb61e5a0899491c4a0cd5
-
SHA512
4d72a76dc8092086f0a43e30325702f9f9162e3f9b0fa06b893b892c070ad39cdb4e2519e2ac1d6cc314dc1cb5f95a07e7c669c309b75de8261a3ec06444e9eb
-
SSDEEP
3072:eF//B8iAvml6GFn8OhN8OkxZhK28AyZxIpXmDzWE7By93iSFzcC:4//ufGt84N8Okbh5YxuW9Nyv/
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Public\HEX-5823-6893-6818\manager.exe = "C:\\Users\\Public\\HEX-5823-6893-6818\\manager.exe:*:Enabled:Java Update Manager" d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe -
Executes dropped EXE 3 IoCs
pid Process 1680 manager.exe 5024 manager.exe 4064 manager.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Update Manager = "C:\\Users\\Public\\HEX-5823-6893-6818\\manager.exe" d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe File opened for modification \??\PhysicalDrive0 manager.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\winrtsnr.txt manager.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3032 set thread context of 1016 3032 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 85 PID 1016 set thread context of 2032 1016 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 86 PID 1680 set thread context of 5024 1680 manager.exe 88 PID 5024 set thread context of 4064 5024 manager.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language manager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language manager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language manager.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3032 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 1016 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 1680 manager.exe 5024 manager.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 3032 wrote to memory of 1016 3032 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 85 PID 3032 wrote to memory of 1016 3032 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 85 PID 3032 wrote to memory of 1016 3032 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 85 PID 3032 wrote to memory of 1016 3032 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 85 PID 3032 wrote to memory of 1016 3032 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 85 PID 3032 wrote to memory of 1016 3032 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 85 PID 3032 wrote to memory of 1016 3032 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 85 PID 3032 wrote to memory of 1016 3032 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 85 PID 1016 wrote to memory of 2032 1016 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 86 PID 1016 wrote to memory of 2032 1016 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 86 PID 1016 wrote to memory of 2032 1016 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 86 PID 1016 wrote to memory of 2032 1016 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 86 PID 1016 wrote to memory of 2032 1016 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 86 PID 1016 wrote to memory of 2032 1016 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 86 PID 1016 wrote to memory of 2032 1016 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 86 PID 1016 wrote to memory of 2032 1016 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 86 PID 2032 wrote to memory of 1680 2032 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 87 PID 2032 wrote to memory of 1680 2032 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 87 PID 2032 wrote to memory of 1680 2032 d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe 87 PID 1680 wrote to memory of 5024 1680 manager.exe 88 PID 1680 wrote to memory of 5024 1680 manager.exe 88 PID 1680 wrote to memory of 5024 1680 manager.exe 88 PID 1680 wrote to memory of 5024 1680 manager.exe 88 PID 1680 wrote to memory of 5024 1680 manager.exe 88 PID 1680 wrote to memory of 5024 1680 manager.exe 88 PID 1680 wrote to memory of 5024 1680 manager.exe 88 PID 1680 wrote to memory of 5024 1680 manager.exe 88 PID 5024 wrote to memory of 4064 5024 manager.exe 89 PID 5024 wrote to memory of 4064 5024 manager.exe 89 PID 5024 wrote to memory of 4064 5024 manager.exe 89 PID 5024 wrote to memory of 4064 5024 manager.exe 89 PID 5024 wrote to memory of 4064 5024 manager.exe 89 PID 5024 wrote to memory of 4064 5024 manager.exe 89 PID 5024 wrote to memory of 4064 5024 manager.exe 89 PID 5024 wrote to memory of 4064 5024 manager.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d2fd718b7af52fecb60dc352cad16741_JaffaCakes118.exe"3⤵
- Modifies firewall policy service
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Public\HEX-5823-6893-6818\manager.exe"C:\Users\Public\HEX-5823-6893-6818\manager.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Public\HEX-5823-6893-6818\manager.exe"C:\Users\Public\HEX-5823-6893-6818\manager.exe"5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Public\HEX-5823-6893-6818\manager.exe"C:\Users\Public\HEX-5823-6893-6818\manager.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4064
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5d2fd718b7af52fecb60dc352cad16741
SHA1e2e1086ff9080bfb748f17745721a3ce3f28dcd5
SHA2560bf0548c2b9d4dbc4be0b3056393c71028108ea2b66cb61e5a0899491c4a0cd5
SHA5124d72a76dc8092086f0a43e30325702f9f9162e3f9b0fa06b893b892c070ad39cdb4e2519e2ac1d6cc314dc1cb5f95a07e7c669c309b75de8261a3ec06444e9eb