Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 13:32
Behavioral task
behavioral1
Sample
dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe
-
Size
38KB
-
MD5
dc5b50523a957f642b96eed93363f6b5
-
SHA1
471ba19dec8d33057a73bbd04d0bf962b68f3fd6
-
SHA256
fb9e34230f77529ed70cbbb9ef92d2d65ba379e7c795f41cf92b8650f4380338
-
SHA512
4b6e129cf659fbc933394afa0301c7d6d6c8110d1ce48776e13ba88dcf5fc983ab0c6f14ece0a16d1892f9373614f78c6838cef4add74f806b51dcb5ca5d98b9
-
SSDEEP
768:bOvHPRamDrCFnAcBDu4RMEGx8JPj2cBPkbtgxV6tm2/:bOncmDMnAcBDuk2x85j5mbtC6w2/
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4068 rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 4068 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3292-0-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/3292-13-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/3292-16-0x0000000000400000-0x0000000000418000-memory.dmp upx -
Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\yumsimg32.dll dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllcache\midimap.dll dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe File created C:\Windows\SysWOW64\msimg32.dll dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe File created C:\Windows\SysWOW64\yuksuser.dll dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\yuksuser.dll dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe File created C:\Windows\SysWOW64\ksuser.dll dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllcache\ksuser.dll dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe File created C:\Windows\SysWOW64\yumidimap.dll dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe File created C:\Windows\SysWOW64\midimap.dll dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllcache\msimg32.dll dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe File created C:\Windows\SysWOW64\sysapp10.dll dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3740 sc.exe 4596 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3292 wrote to memory of 4748 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 83 PID 3292 wrote to memory of 4748 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 83 PID 3292 wrote to memory of 4748 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 83 PID 3292 wrote to memory of 3740 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 84 PID 3292 wrote to memory of 3740 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 84 PID 3292 wrote to memory of 3740 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 84 PID 3292 wrote to memory of 4596 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 85 PID 3292 wrote to memory of 4596 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 85 PID 3292 wrote to memory of 4596 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 85 PID 4748 wrote to memory of 1772 4748 net.exe 89 PID 4748 wrote to memory of 1772 4748 net.exe 89 PID 4748 wrote to memory of 1772 4748 net.exe 89 PID 3292 wrote to memory of 4068 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 93 PID 3292 wrote to memory of 4068 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 93 PID 3292 wrote to memory of 4068 3292 dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc5b50523a957f642b96eed93363f6b5_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\net.exenet stop cryptsvc2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop cryptsvc3⤵
- System Location Discovery: System Language Discovery
PID:1772
-
-
-
C:\Windows\SysWOW64\sc.exesc config cryptsvc start= disabled2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3740
-
-
C:\Windows\SysWOW64\sc.exesc delete cryptsvc2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4596
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Users\Admin\AppData\Local\Temp\1726147924.dat, ServerMain c:\users\admin\appdata\local\temp\dc5b50523a957f642b96eed93363f6b5_jaffacakes118.exe2⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5721923cb55d79d01a03ef400392a9d6f
SHA1c3b454543c6b9a6f89aa726f826a9a48c81f67c0
SHA256b7d2296002a41417ca177fbc1881c56ee82bf5f05c4c2703c8e2f50f1900e0cb
SHA512efbbab568980bb666fde43a287b30fb251c09df8874b60ef9e47dc19c0736e2fc3700b2c92cb78ba4c68b35728e6137a3b8f3fecf4f1f163a83fe0709d0bd059