Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/09/2024, 09:34
Static task
static1
Behavioral task
behavioral1
Sample
e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
-
Size
14.2MB
-
MD5
e22e4582ca0520fc2dae75e26b35ce0b
-
SHA1
ea4ae8aa9a3462164f353258b5dfdf56a27a793f
-
SHA256
27228c21c361bb848fb33435b9a8c8f32e48e284f5919dec1a34c999bdc54582
-
SHA512
bb0a3af630dd49c27a1882d367ba2a9e7348c7d69dc2d1e830297341fff67f5f9fc7a63e6b305a997cc2e02ee379f47a5af834430628d47be7b992c1c11ca176
-
SSDEEP
49152:YJLc1kqIk5yFDgCRX6H4FPT0HB+ZGB/p43O7w9VFZnpu+2RJli7VS5C:Ya1p55YfRqH1xtUFNpuBRJli7VS5C
Malware Config
Signatures
-
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Tasks\AntispywareBot Scheduled Scan.job e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe File created C:\Windows\Tasks\AntispywareBot System Startup.job e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe File opened for modification C:\Windows\Tasks\AntispywareBot Scheduled Scan.job e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeBackupPrivilege 3296 e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe Token: SeRestorePrivilege 3296 e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3296 e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3296 e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3296 e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe 3296 e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe 3296 e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe 3296 e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
610B
MD5041b8405c7ae860386be398df1bbd99b
SHA176a4bf2623c43b49921469fe8638ce83d254fd90
SHA2565aae1f72c4379071e55d8bb3292157dbeae6f120023981da405bb399d4b85ea5
SHA512174031a4c67c5e3eba71784b98914ad0c3b9a6d38881a5497f3263fe7f3bac3b5205896234c52aa2b22d6c4ec17ac7e3818f145016ef2246d33d56f31498db3f