Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/09/2024, 11:02
Static task
static1
Behavioral task
behavioral1
Sample
e254e83899db63edd94362d3694ae647_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
e254e83899db63edd94362d3694ae647_JaffaCakes118.exe
-
Size
73KB
-
MD5
e254e83899db63edd94362d3694ae647
-
SHA1
bccf2d460dae96a766d2978c4a5178e654e80dd8
-
SHA256
52633981af075259928529e089741f226aefb674c179982d1c45276c27e3667e
-
SHA512
b973848eccb726eaca1c9600493e91e4ab4d8ab8526dc4b0d2d1af09570cdefaae12930b84f2c56cb73306ce6cc663ef69d592899cecd8b5bc045a38576f9e40
-
SSDEEP
1536:p4MEpRNE4FMmRWEcT4YRFYNE3C4SIE/147M1gRQ/ESEhtRPDqIR844EiRr4WMkRN:p4MEpRNE4FMmRWEcT4YRFYNE3C4DE/1U
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 cloudrelated.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE cloudrelated.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies cloudrelated.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 cloudrelated.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e254e83899db63edd94362d3694ae647_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e254e83899db63edd94362d3694ae647_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cloudrelated.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cloudrelated.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier e254e83899db63edd94362d3694ae647_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier e254e83899db63edd94362d3694ae647_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier cloudrelated.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier cloudrelated.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cloudrelated.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cloudrelated.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cloudrelated.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe 4340 cloudrelated.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2900 e254e83899db63edd94362d3694ae647_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2900 2928 e254e83899db63edd94362d3694ae647_JaffaCakes118.exe 83 PID 2928 wrote to memory of 2900 2928 e254e83899db63edd94362d3694ae647_JaffaCakes118.exe 83 PID 2928 wrote to memory of 2900 2928 e254e83899db63edd94362d3694ae647_JaffaCakes118.exe 83 PID 4876 wrote to memory of 4340 4876 cloudrelated.exe 94 PID 4876 wrote to memory of 4340 4876 cloudrelated.exe 94 PID 4876 wrote to memory of 4340 4876 cloudrelated.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\e254e83899db63edd94362d3694ae647_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e254e83899db63edd94362d3694ae647_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\e254e83899db63edd94362d3694ae647_JaffaCakes118.exe--7f25830d2⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: RenamesItself
PID:2900
-
-
C:\Windows\SysWOW64\cloudrelated.exe"C:\Windows\SysWOW64\cloudrelated.exe"1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cloudrelated.exe--5e41be882⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4340
-