Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 19:44
Static task
static1
Behavioral task
behavioral1
Sample
d5009998f1118ae294ca2c3c8908cae6_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
d5009998f1118ae294ca2c3c8908cae6_JaffaCakes118.exe
-
Size
264KB
-
MD5
d5009998f1118ae294ca2c3c8908cae6
-
SHA1
905b98f74f77d38bf124547834e8a79b3d2079e1
-
SHA256
4a1a1651d2c28a9076fb55471afdb02d0fd6767e9e26a9a212abccb16c4902a0
-
SHA512
e1d28da2ac0a3338f2a81917c122a92a8962ba7118d8742f523d4d67a6f7ad218dae2d9e2995ab255a052ac0fc2acc69000793105855e41816d089867444385b
-
SSDEEP
3072:XHWbju7cx9WiPFMydonbMXUSqlDGW1joJsw/4qciRA6SP1oeRcIwLswQVqvCD:mXfCx3bYjOoqf5nqew4wqqKD
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" tazebama.dl_ -
Executes dropped EXE 1 IoCs
pid Process 1028 tazebama.dl_ -
Loads dropped DLL 1 IoCs
pid Process 952 d5009998f1118ae294ca2c3c8908cae6_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: tazebama.dl_ File opened (read-only) \??\X: tazebama.dl_ File opened (read-only) \??\U: tazebama.dl_ File opened (read-only) \??\S: tazebama.dl_ File opened (read-only) \??\P: tazebama.dl_ File opened (read-only) \??\N: tazebama.dl_ File opened (read-only) \??\I: tazebama.dl_ File opened (read-only) \??\Z: tazebama.dl_ File opened (read-only) \??\Y: tazebama.dl_ File opened (read-only) \??\G: tazebama.dl_ File opened (read-only) \??\H: tazebama.dl_ File opened (read-only) \??\W: tazebama.dl_ File opened (read-only) \??\O: tazebama.dl_ File opened (read-only) \??\R: tazebama.dl_ File opened (read-only) \??\M: tazebama.dl_ File opened (read-only) \??\L: tazebama.dl_ File opened (read-only) \??\K: tazebama.dl_ File opened (read-only) \??\J: tazebama.dl_ File opened (read-only) \??\E: tazebama.dl_ File opened (read-only) \??\V: tazebama.dl_ File opened (read-only) \??\T: tazebama.dl_ -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf tazebama.dl_ File opened for modification F:\autorun.inf tazebama.dl_ File opened for modification C:\autorun.inf tazebama.dl_ -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32.EXE tazebama.dl_ -
Program crash 1 IoCs
pid pid_target Process procid_target 5044 1028 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tazebama.dl_ Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5009998f1118ae294ca2c3c8908cae6_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1028 tazebama.dl_ 1028 tazebama.dl_ -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 952 wrote to memory of 1028 952 d5009998f1118ae294ca2c3c8908cae6_JaffaCakes118.exe 85 PID 952 wrote to memory of 1028 952 d5009998f1118ae294ca2c3c8908cae6_JaffaCakes118.exe 85 PID 952 wrote to memory of 1028 952 d5009998f1118ae294ca2c3c8908cae6_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5009998f1118ae294ca2c3c8908cae6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5009998f1118ae294ca2c3c8908cae6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 7403⤵
- Program crash
PID:5044
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1028 -ip 10281⤵PID:4560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD531f6743d7ded03af5796bb37a8427f55
SHA184c2ee2af66b5ed4f0e7f685e60fff921c9b0763
SHA256c0543b1c53cc216fdfc4f6ca59486784a4672bb0a9f56be0d306c77963374ba7
SHA512a1b7210cc84548b9a70fb7bf69b9d1e0f9ab916084031826b6274ae7f1784ae6c02e6808de77345c2839c2ea03f787285dd725bc6afaf86854ec85962065eed7
-
Filesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c
-
Filesize
126B
MD5163e20cbccefcdd42f46e43a94173c46
SHA14c7b5048e8608e2a75799e00ecf1bbb4773279ae
SHA2567780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e
SHA512e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8
-
Filesize
151KB
MD54e47e9db8a23c78f390ef129ad0168db
SHA10cd70c731f3f519715fa76093699eda2ae2f6330
SHA2562c94e06a3c6e760ba7f40f58fc678fef2700ee1c6b6af7a16b669f78cff9a1b5
SHA512abe842e69d12f0ad25a36d03deb1787a515de0d7d12831b33797c5483ea92af74388906e224a85403f63eebceab501d74d2f73629e3f5d4e8f5bee77bde957be
-
Filesize
151KB
MD5547779852b7b826fd1fc6f15b63b42b1
SHA169b7da556282e02d2ef9605edcaa9e8187e1897b
SHA256bc6ec777c76d599577cdbc1e8a5b35c3411cf82326c6b086e6f45a270f43af6a
SHA5127151e9da26a0bd60ea1e40b24ba42dc21b5facb2e9990e867bf55613a99cbd7be5bad6e53add3204ed0d2ada8d98366748b62a8b83ea2c64213618a68b254950