Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2024, 23:45
Static task
static1
Behavioral task
behavioral1
Sample
eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe
-
Size
415KB
-
MD5
eeab196173b97cbeabfc8b6756c9fe34
-
SHA1
fe7560d22163187efcf8f763e2d0fd9d385f6f7d
-
SHA256
c8c45b7f615229bd84b9b3f765426b22269011219c3fc10cc11131627edfed21
-
SHA512
1e2c19aabda8d26fde2a4ed2323067cc874881e850c299c29757f386ceeb6eeef9bdcd4258ffa798157a944482f2cb9f08c692508b72bc3346f893a01b8b32a3
-
SSDEEP
6144:e1ojUwD3TilJTq4y+ydvMQp7Tmd7xG8twYU42vw:eKowTWTq4yzd/tS7U8tEn
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2308 iKnDfGg08200.exe -
Executes dropped EXE 1 IoCs
pid Process 2308 iKnDfGg08200.exe -
resource yara_rule behavioral2/memory/1792-3-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/1792-6-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/1792-5-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/1792-1-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2308-20-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2308-19-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/1792-24-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2308-26-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2308-38-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/1792-45-0x0000000000400000-0x00000000004B3000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iKnDfGg08200 = "C:\\ProgramData\\iKnDfGg08200\\iKnDfGg08200.exe" iKnDfGg08200.exe -
Program crash 28 IoCs
pid pid_target Process procid_target 1948 1792 WerFault.exe 81 4424 1792 WerFault.exe 81 2164 2308 WerFault.exe 87 1220 1792 WerFault.exe 81 2640 2308 WerFault.exe 87 1292 1792 WerFault.exe 81 1952 2308 WerFault.exe 87 1500 1792 WerFault.exe 81 4372 1792 WerFault.exe 81 2736 2308 WerFault.exe 87 1740 1792 WerFault.exe 81 440 2308 WerFault.exe 87 2904 1792 WerFault.exe 81 2416 2308 WerFault.exe 87 976 1792 WerFault.exe 81 4140 2308 WerFault.exe 87 1976 2308 WerFault.exe 87 3716 2308 WerFault.exe 87 2488 2308 WerFault.exe 87 2032 2308 WerFault.exe 87 3704 2308 WerFault.exe 87 2576 2308 WerFault.exe 87 1872 2308 WerFault.exe 87 4984 2308 WerFault.exe 87 208 1792 WerFault.exe 81 5112 1792 WerFault.exe 81 2632 2308 WerFault.exe 87 1184 2308 WerFault.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iKnDfGg08200.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe Token: SeDebugPrivilege 2308 iKnDfGg08200.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2308 iKnDfGg08200.exe 2308 iKnDfGg08200.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2308 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 87 PID 1792 wrote to memory of 2308 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 87 PID 1792 wrote to memory of 2308 1792 eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 5642⤵
- Program crash
PID:1948
-
-
C:\ProgramData\iKnDfGg08200\iKnDfGg08200.exe"C:\ProgramData\iKnDfGg08200\iKnDfGg08200.exe" "C:\Users\Admin\AppData\Local\Temp\eeab196173b97cbeabfc8b6756c9fe34_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2308 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 7403⤵
- Program crash
PID:2164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 7483⤵
- Program crash
PID:2640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 8083⤵
- Program crash
PID:1952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 8043⤵
- Program crash
PID:2736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 8123⤵
- Program crash
PID:440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 9803⤵
- Program crash
PID:2416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 10123⤵
- Program crash
PID:4140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 9723⤵
- Program crash
PID:1976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 13923⤵
- Program crash
PID:3716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 16043⤵
- Program crash
PID:2488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 9283⤵
- Program crash
PID:2032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 6483⤵
- Program crash
PID:3704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 16803⤵
- Program crash
PID:2576
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 17923⤵
- Program crash
PID:1872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 18123⤵
- Program crash
PID:4984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 11563⤵
- Program crash
PID:2632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 7963⤵
- Program crash
PID:1184
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 6282⤵
- Program crash
PID:4424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 8042⤵
- Program crash
PID:1220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 8122⤵
- Program crash
PID:1292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 8122⤵
- Program crash
PID:1500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 8322⤵
- Program crash
PID:4372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 10082⤵
- Program crash
PID:1740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 10282⤵
- Program crash
PID:2904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 11282⤵
- Program crash
PID:976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 6522⤵
- Program crash
PID:208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 1522⤵
- Program crash
PID:5112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1792 -ip 17921⤵PID:4776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1792 -ip 17921⤵PID:4672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1792 -ip 17921⤵PID:4604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2308 -ip 23081⤵PID:3356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2308 -ip 23081⤵PID:832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1792 -ip 17921⤵PID:3424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2308 -ip 23081⤵PID:4060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1792 -ip 17921⤵PID:4980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1792 -ip 17921⤵PID:2916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2308 -ip 23081⤵PID:1312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1792 -ip 17921⤵PID:3812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2308 -ip 23081⤵PID:2176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1792 -ip 17921⤵PID:2524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2308 -ip 23081⤵PID:1716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1792 -ip 17921⤵PID:4784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2308 -ip 23081⤵PID:1548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2308 -ip 23081⤵PID:3756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2308 -ip 23081⤵PID:3496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2308 -ip 23081⤵PID:4676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2308 -ip 23081⤵PID:3336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 2308 -ip 23081⤵PID:4776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2308 -ip 23081⤵PID:3700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2308 -ip 23081⤵PID:5108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2308 -ip 23081⤵PID:4424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 1792 -ip 17921⤵PID:5080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 1792 -ip 17921⤵PID:3164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2308 -ip 23081⤵PID:116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 2308 -ip 23081⤵PID:2104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
415KB
MD5ddccd9552a5efe802c3a3910830dd0fa
SHA193c5c6ad8b2b4fa3f4eec8ba11a810bb40147359
SHA256e19ef9effc84e29d8d62d90111eb5ba1e66bb48ed34d8cfcf4d75ba8030ab4a4
SHA512940e1b0e4ee06c5b1259b5d24bf1005b4ddd43cb4d6978d187a848e1679edb57b9587a6de84a11dd18d84829b552e4b306b80bd9c53e010c79bca168cc449a7b