Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 16:14
Static task
static1
Behavioral task
behavioral1
Sample
fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe
-
Size
62KB
-
MD5
fababf22438aec1aaf0a3369babce8a2
-
SHA1
77b5fa4ed2b2830821ec4c1fb536970dc6122108
-
SHA256
f61ad38a058d71dccc6ed18ba2cb065accb4420eef38d39afa94e4068329a9be
-
SHA512
67eea8d25fb068b5fdbf776953df8ccd78a2a9dde52acef027087d772aab87feaf8e8ed6ecd0e53eb9ca57b41e478d4f178ecf807eb00089e2bedb73c4e9a448
-
SSDEEP
768:wfzNyAGva4H7sDGvXSqZtc4HBSw8+CPRR0X5rIVdshMgEN/IuTWl9U7:SyAVDGvXSmnHBSwCORMIdENRG9U7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4276 panel.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\panel = "C:\\Users\\Admin\\AppData\\Roaming\\panel\\panel.exe -b" fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language panel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe 4276 panel.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4976 fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe Token: SeDebugPrivilege 4276 panel.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4976 fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe 4276 panel.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 4976 wrote to memory of 4276 4976 fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe 82 PID 4976 wrote to memory of 4276 4976 fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe 82 PID 4976 wrote to memory of 4276 4976 fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe 82 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4976 wrote to memory of 2792 4976 fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe 83 PID 4976 wrote to memory of 2792 4976 fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe 83 PID 4976 wrote to memory of 2792 4976 fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe 83 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56 PID 4276 wrote to memory of 3444 4276 panel.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fababf22438aec1aaf0a3369babce8a2_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Roaming\panel\panel.exe-b3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4276
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\panel\upd.bat"3⤵
- System Location Discovery: System Language Discovery
PID:2792
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5fababf22438aec1aaf0a3369babce8a2
SHA177b5fa4ed2b2830821ec4c1fb536970dc6122108
SHA256f61ad38a058d71dccc6ed18ba2cb065accb4420eef38d39afa94e4068329a9be
SHA51267eea8d25fb068b5fdbf776953df8ccd78a2a9dde52acef027087d772aab87feaf8e8ed6ecd0e53eb9ca57b41e478d4f178ecf807eb00089e2bedb73c4e9a448
-
Filesize
1KB
MD565eb939e92341c070497b5628886a51d
SHA16163015215379a6e499d6cdf9d964605a10e4150
SHA256e3e1f4167ab849c074b188787a9f298114afe85f4d0321d3061d990fdc49ff09
SHA5126614724d75520b7ac6264b9da3e8c8511582adb79860bf07a9118f4bff418370b629c8fe6a745950658b40e3b2125fd8e452281a2946caddbce5ea13cbeb1009