Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 07:04
Static task
static1
Behavioral task
behavioral1
Sample
ead087d71c15d6932b9c220e81f99c44_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ead087d71c15d6932b9c220e81f99c44_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ead087d71c15d6932b9c220e81f99c44_JaffaCakes118.exe
-
Size
340KB
-
MD5
ead087d71c15d6932b9c220e81f99c44
-
SHA1
295a8f3d8f06175113a848779c9b31a939aa1e97
-
SHA256
0cd8b17ced5bf545217511a8f495e242d11693337e303e7325f15ec8a967f384
-
SHA512
d3c2d13c53a1c1e732290db76e191bde06ce315c8a4cb16531d90e87e51c29417c46f04aa461e308fd59a57e77bd448732cdb8d6a522b3179d3dbd4ffef46792
-
SSDEEP
3072:H99vdvoskP+15fqUP+qiV58O7N8nmcKG1GUXu7nOCtf3D5ZourNMqLC08ffVIWWT:djfflWp4znRKCLuXxvrsd9WiwHHo3p
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation ead087d71c15d6932b9c220e81f99c44_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4776 dsvgoaklyu.exe -
Loads dropped DLL 1 IoCs
pid Process 4776 dsvgoaklyu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2444 2568 WerFault.exe 81 1044 4776 WerFault.exe 93 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ead087d71c15d6932b9c220e81f99c44_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dsvgoaklyu.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4764 cmd.exe 3260 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 4148 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3260 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4148 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2568 wrote to memory of 4764 2568 ead087d71c15d6932b9c220e81f99c44_JaffaCakes118.exe 85 PID 2568 wrote to memory of 4764 2568 ead087d71c15d6932b9c220e81f99c44_JaffaCakes118.exe 85 PID 2568 wrote to memory of 4764 2568 ead087d71c15d6932b9c220e81f99c44_JaffaCakes118.exe 85 PID 4764 wrote to memory of 4148 4764 cmd.exe 87 PID 4764 wrote to memory of 4148 4764 cmd.exe 87 PID 4764 wrote to memory of 4148 4764 cmd.exe 87 PID 4764 wrote to memory of 3260 4764 cmd.exe 91 PID 4764 wrote to memory of 3260 4764 cmd.exe 91 PID 4764 wrote to memory of 3260 4764 cmd.exe 91 PID 4764 wrote to memory of 4776 4764 cmd.exe 93 PID 4764 wrote to memory of 4776 4764 cmd.exe 93 PID 4764 wrote to memory of 4776 4764 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\ead087d71c15d6932b9c220e81f99c44_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ead087d71c15d6932b9c220e81f99c44_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 5562⤵
- Program crash
PID:2444
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2568 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ead087d71c15d6932b9c220e81f99c44_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\DSVGOA~1.EXE -f2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 25683⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3260
-
-
C:\Users\Admin\AppData\Local\dsvgoaklyu.exeC:\Users\Admin\AppData\Local\DSVGOA~1.EXE -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 5764⤵
- Program crash
PID:1044
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2568 -ip 25681⤵PID:3148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4776 -ip 47761⤵PID:4732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340KB
MD5ead087d71c15d6932b9c220e81f99c44
SHA1295a8f3d8f06175113a848779c9b31a939aa1e97
SHA2560cd8b17ced5bf545217511a8f495e242d11693337e303e7325f15ec8a967f384
SHA512d3c2d13c53a1c1e732290db76e191bde06ce315c8a4cb16531d90e87e51c29417c46f04aa461e308fd59a57e77bd448732cdb8d6a522b3179d3dbd4ffef46792