Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 17:41
Static task
static1
Behavioral task
behavioral1
Sample
f0512af001cddec57c780943bc07d8c4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f0512af001cddec57c780943bc07d8c4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f0512af001cddec57c780943bc07d8c4_JaffaCakes118.exe
-
Size
300KB
-
MD5
f0512af001cddec57c780943bc07d8c4
-
SHA1
54a32ebb2018c4cc7b2e63623f9d844915ae4686
-
SHA256
416ba004e285fa78e59179938c3264121a7af7369d43f7593be769e172ef393e
-
SHA512
cffa5b4eba452607cadaf3469dd8df3af87607c8331974e965f0ed9a0bf5116704740979f11b359e997bfb9fdae6d7fa4256240ca48a7a8656e9574b6b9d32f4
-
SSDEEP
6144:2jPeicXUPWad3LCwfaDWkkqiIPyeoE7QZCFaVROp/AMsTOW:2asPvd7CwgbiIMAQMon/M6N
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0D1E8.exe.exe .Download-Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0D1E8.exe.exe .Download-Server.exe -
Executes dropped EXE 1 IoCs
pid Process 4120 .Download-Server.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f0512af001cddec57c780943bc07d8c4_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0512af001cddec57c780943bc07d8c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language .Download-Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4120 .Download-Server.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3368 wrote to memory of 4120 3368 f0512af001cddec57c780943bc07d8c4_JaffaCakes118.exe 82 PID 3368 wrote to memory of 4120 3368 f0512af001cddec57c780943bc07d8c4_JaffaCakes118.exe 82 PID 3368 wrote to memory of 4120 3368 f0512af001cddec57c780943bc07d8c4_JaffaCakes118.exe 82 PID 4120 wrote to memory of 1036 4120 .Download-Server.exe 83 PID 4120 wrote to memory of 1036 4120 .Download-Server.exe 83 PID 4120 wrote to memory of 1036 4120 .Download-Server.exe 83 PID 1036 wrote to memory of 2988 1036 net.exe 85 PID 1036 wrote to memory of 2988 1036 net.exe 85 PID 1036 wrote to memory of 2988 1036 net.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0512af001cddec57c780943bc07d8c4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0512af001cddec57c780943bc07d8c4_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\.Download-Server.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\.Download-Server.exe2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\net.exenet stop wscsvc3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc4⤵
- System Location Discovery: System Language Discovery
PID:2988
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5ca8c0aca646aae4a7029ae898efc346d
SHA1785ca48171fd02481769f46d504897f025f42d41
SHA25667ba1b63d2ccd57013b42cccc4bcfd4537c9cab98a128f1a1e365c86645a67c6
SHA5127fbb337e5cb97a05217ac679523d926f213007d053d9823fa980b46ef091557be74c933034ff5ea3efb301915d00d6dfe60f8a7d39c54cdc6946ca0abac1223a