Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/09/2024, 03:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe
-
Size
4.0MB
-
MD5
f7699f2954ca4a8fc483fc909d5e63de
-
SHA1
3a31a9060ba091f4fe58b1e8ccacee93c8d5f5e1
-
SHA256
8d74fdc45bdb6c5acf3e54e3828944bb270b6c9e46dd44f0a0932ee85ccfa5d9
-
SHA512
2a2dccad1b1ff2aabdd7f8c1bb6158b1a32b381a0cd5f13165d0ae46d7129bfc5d39d7c1cc5508d948bd71be0f0a7b21968d1894dc62eb03161ff918847fe434
-
SSDEEP
192:NfEUdP85+BJBalIub/8nkOCkkN4DClW2QFbwuQIGxLOQ6r4J1LYX5eMKnq4gwkaq:egBJBalIQ/8qn3PuPL
Score
10/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msindex = "\\msindexx\\msintell.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msupdater = "C:\\Users\\Admin\\msserver.exe" f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msindex = "C:\\Users\\Admin\\AppData\\Roaming\\msindexx\\msintell.exe" RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3232 set thread context of 1292 3232 f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1292 RegAsm.exe 1292 RegAsm.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1292 RegAsm.exe 4648 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1292 RegAsm.exe Token: 33 1292 RegAsm.exe Token: SeIncBasePriorityPrivilege 1292 RegAsm.exe Token: SeDebugPrivilege 4648 Taskmgr.exe Token: SeSystemProfilePrivilege 4648 Taskmgr.exe Token: SeCreateGlobalPrivilege 4648 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe 4648 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1292 RegAsm.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3232 wrote to memory of 1292 3232 f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe 87 PID 3232 wrote to memory of 1292 3232 f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe 87 PID 3232 wrote to memory of 1292 3232 f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe 87 PID 3232 wrote to memory of 1292 3232 f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe 87 PID 3232 wrote to memory of 1292 3232 f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe 87 PID 3232 wrote to memory of 1292 3232 f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe 87 PID 3232 wrote to memory of 1292 3232 f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe 87 PID 3232 wrote to memory of 1292 3232 f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe 87 PID 1292 wrote to memory of 4648 1292 RegAsm.exe 90 PID 1292 wrote to memory of 4648 1292 RegAsm.exe 90 PID 1292 wrote to memory of 4648 1292 RegAsm.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"3⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4648
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52B
MD506f513fe92fd68a11fc4b6926d51cf47
SHA1f56e998fea5befa4ac1f2313eb5db24d6c6c0d0a
SHA2560296eaf97f831b705512a9b669b354a0889b16f44f082ecf073b69c25b77aa42
SHA51279f668c917d8e66e6f3dcd298a7429a6be7a9e6087b8c39c8d3e6de071b8fa05b29f41b0f764ecf7de12142c13bfe197efa9cb144ef2cc2e08a1c11080ed23dc