Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 16:14
Static task
static1
Behavioral task
behavioral1
Sample
f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe
-
Size
2.8MB
-
MD5
f6626e65f1eb82888caee56c3f658b89
-
SHA1
8a45d192c080a0923cbc2757df086d34b39c63e1
-
SHA256
41aff36e468738584879894efb4062f634c5bfe9c9300db8e15fe3f638f85f95
-
SHA512
10ec80ec7db80e0c39f48d688a06ca3cde6c4dd37a26dc872967f3d663cc2dc2dd26d2211877c23e72f965189ab784fd851f0e45f3e2899ab96070957e5fa877
-
SSDEEP
49152:2hUacRT39VIQfT3WUacRT39VIQfTzWUacRT39VIQfTfWUacRT39VIQfT:2hUzRjwQfjWUzRjwQfHWUzRjwQfLWUzJ
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4944 228 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3416 schtasks.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 228 wrote to memory of 3368 228 f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe 82 PID 228 wrote to memory of 3368 228 f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe 82 PID 228 wrote to memory of 3368 228 f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe 82 PID 228 wrote to memory of 976 228 f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe 83 PID 228 wrote to memory of 976 228 f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe 83 PID 228 wrote to memory of 976 228 f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe 83 PID 3368 wrote to memory of 3416 3368 cmd.exe 87 PID 3368 wrote to memory of 3416 3368 cmd.exe 87 PID 3368 wrote to memory of 3416 3368 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\cmd.execmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\d0c5ac152f4348afb5bb7d5f6c508b2d.xml"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\d0c5ac152f4348afb5bb7d5f6c508b2d.xml"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3416
-
-
-
C:\Users\Admin\AppData\Local\Temp\f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6626e65f1eb82888caee56c3f658b89_JaffaCakes118.exe"2⤵PID:976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 8162⤵
- Program crash
PID:4944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 228 -ip 2281⤵PID:4208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56de1b33159e6c1e8ad0623dae37a195a
SHA12dc90fd881c260703196f00e488575ccb4bb1757
SHA2569a303f8f55dac23c8026c379e9db7889b6dcdcae84eef224abf5b383d3f69033
SHA5122306e3abf098c954bc4b1df40befbde3098d356f1aadae860b0c23556025eb5abdfef9408a01d43a3286739db3cb8b892a0607998fc222fb88e5d1acafd68c9d