Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/09/2024, 16:43
Static task
static1
Behavioral task
behavioral1
Sample
e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe
-
Size
304KB
-
MD5
e2efb26151a3a5c2e9b4d144e296b025
-
SHA1
b932bdcf98af633a2f7c69520175ad05700b5a60
-
SHA256
e93041777d59c7ffaac50f59021867165b51fec031a831344e841b96c9eee285
-
SHA512
0dc0115d329b0cccfbe393fd51d08632be59a20356fa73cb6cf8a61dfa1affda25dc0b0a979e5ad50f346b4b9ec8fb499e62a966c09fdc8607686fd48800d113
-
SSDEEP
6144:Q0q7I4TBHaaLw+7EnQuwSbT0lLHD/q+VpZuAi:Qj7Im6T6M3wSn85pZuf
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language searchahei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language searchahei.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3488 e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe 3488 e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe 4124 e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe 4124 e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe 1092 searchahei.exe 1092 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe 4752 searchahei.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4124 e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3488 wrote to memory of 4124 3488 e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe 82 PID 3488 wrote to memory of 4124 3488 e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe 82 PID 3488 wrote to memory of 4124 3488 e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe 82 PID 1092 wrote to memory of 4752 1092 searchahei.exe 88 PID 1092 wrote to memory of 4752 1092 searchahei.exe 88 PID 1092 wrote to memory of 4752 1092 searchahei.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e2efb26151a3a5c2e9b4d144e296b025_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:4124
-
-
C:\Windows\SysWOW64\searchahei.exe"C:\Windows\SysWOW64\searchahei.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\searchahei.exe"C:\Windows\SysWOW64\searchahei.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4752
-