Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 17:42
Static task
static1
Behavioral task
behavioral1
Sample
d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe
-
Size
191KB
-
MD5
d27e6746c0a16238b2fc5ab1122adbb5
-
SHA1
da48aa752344f1b29c2d7b2d03b3c600e4aacdf0
-
SHA256
8b1c10954211688ca33557605da9aa20c88529ae596344ac541f8d417b8e76b1
-
SHA512
8fb34e9e9a9211c7df7b94badc0facb32f46dee190d30d0e99b1a159f14759cd3aa6821c40a46a774bbedc612e27adec32f4c4986f92d68cc1855bc831214038
-
SSDEEP
3072:nXOmpueXMMk1ka/zse8H7yPmKu7FQilRFqbhhOVtpYtJRZi2l6noFbSqbKnwv/KN:XOFeX+kMsf+PAGilR4Vh08tFFl6ooln6
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\found.exe d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\found.exe d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Debug\found32.dll d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB}\InProcServer32\ = "C:\\Windows\\Debug\\found32.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB}\InProcServer32\ThreadingModel = "Apartment" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB}\ = "url" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB}\InProcServer32 regedit.exe -
Runs .reg file with regedit 1 IoCs
pid Process 3192 regedit.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4312 wrote to memory of 4792 4312 d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe 82 PID 4312 wrote to memory of 4792 4312 d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe 82 PID 4312 wrote to memory of 4792 4312 d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe 82 PID 4312 wrote to memory of 3444 4312 d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe 83 PID 4312 wrote to memory of 3444 4312 d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe 83 PID 4312 wrote to memory of 3444 4312 d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe 83 PID 4792 wrote to memory of 3192 4792 cmd.exe 86 PID 4792 wrote to memory of 3192 4792 cmd.exe 86 PID 4792 wrote to memory of 3192 4792 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\fnous.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\regedit.exeregedit /s C:\Users\Admin\AppData\Local\Temp\nothks.reg3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Runs .reg file with regedit
PID:3192
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\d27e6746c0a16238b2fc5ab1122adbb5_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126B
MD57ab275c1bc8750fe49119429e12ab856
SHA1ea556c59c5d3f2be584d2e208ba42a1540f46986
SHA2568d96bacc0e4651d7b8c27613f3f721bb89ca9fb9430bab66b2ef90bfe8cb5bb3
SHA5127fe4bce942523a6adde6d83fc2f63302283f3e0642db4f9f650d50ba8f6f2b7b587229736521615d54b596f24a23146ab7aecb512c145b8dc4b81050ac3576c1
-
Filesize
403B
MD5e1db5e72383ca2535cc04d98efb0f6e6
SHA1b3407d394658ad2d4ef59179fd2ddd419a1dc1d7
SHA25652a9ba0c766a4da941eb674797f1770712e64e2d2104271b4ff6368a45ba5c31
SHA5126ac5c144d0103b722a7203b04f79b3c691ff1393b59555a7ccd454a10a64e2c60111e9e45dc1fdaa3fdf180fac2b0416250aa0180a946c772bd3f1225c15c095