Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 20:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe
-
Size
308KB
-
MD5
ff3cc5b9d609c047b7eb0f717a372c48
-
SHA1
5f95da0e959faed4d23f2dda18230157751a0ad9
-
SHA256
1fe647c8bf4be7c18ba4e65025ed7928829177b180ac23afab686e1898713097
-
SHA512
31d81af2fdfc88a692d3d95c9c0af6286702130f0a653e3dbbdbd28244c902f476c4830305e9a90ad4e91f1d0cbaca005cf62280e4d50b6a0bb466dda6ec8b6b
-
SSDEEP
6144:FlB44GBkAqzqtZdv9kLj3rVfA8BBif3h0/y7p:FQnEKvybrVfA8Eh
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 2540 load.exe 1680 load.exe 1504 load.exe 4048 load.exe 2320 load.exe 3960 load.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\load.exe load.exe File created C:\Windows\SysWOW64\load.exe ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\load.exe ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe File created C:\Windows\SysWOW64\load.exe load.exe File created C:\Windows\SysWOW64\load.exe load.exe File created C:\Windows\SysWOW64\load.exe load.exe File created C:\Windows\SysWOW64\load.exe load.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language load.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language load.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language load.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language load.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language load.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 2540 load.exe 2540 load.exe 2540 load.exe 2540 load.exe 2540 load.exe 2540 load.exe 2540 load.exe 2540 load.exe 2540 load.exe 2540 load.exe 2540 load.exe 2540 load.exe 1680 load.exe 1680 load.exe 1680 load.exe 1680 load.exe 1680 load.exe 1680 load.exe 1680 load.exe 1680 load.exe 1680 load.exe 1680 load.exe 1680 load.exe 1680 load.exe 1504 load.exe 1504 load.exe 1504 load.exe 1504 load.exe 1504 load.exe 1504 load.exe 1504 load.exe 1504 load.exe 1504 load.exe 1504 load.exe 1504 load.exe 1504 load.exe 4048 load.exe 4048 load.exe 4048 load.exe 4048 load.exe 4048 load.exe 4048 load.exe 4048 load.exe 4048 load.exe 4048 load.exe 4048 load.exe 4048 load.exe 4048 load.exe 2320 load.exe 2320 load.exe 2320 load.exe 2320 load.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4724 wrote to memory of 2540 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 82 PID 4724 wrote to memory of 2540 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 82 PID 4724 wrote to memory of 2540 4724 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 82 PID 2540 wrote to memory of 1680 2540 load.exe 91 PID 2540 wrote to memory of 1680 2540 load.exe 91 PID 2540 wrote to memory of 1680 2540 load.exe 91 PID 1680 wrote to memory of 1504 1680 load.exe 93 PID 1680 wrote to memory of 1504 1680 load.exe 93 PID 1680 wrote to memory of 1504 1680 load.exe 93 PID 1504 wrote to memory of 4048 1504 load.exe 94 PID 1504 wrote to memory of 4048 1504 load.exe 94 PID 1504 wrote to memory of 4048 1504 load.exe 94 PID 4048 wrote to memory of 2320 4048 load.exe 95 PID 4048 wrote to memory of 2320 4048 load.exe 95 PID 4048 wrote to memory of 2320 4048 load.exe 95 PID 2320 wrote to memory of 3960 2320 load.exe 96 PID 2320 wrote to memory of 3960 2320 load.exe 96 PID 2320 wrote to memory of 3960 2320 load.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\load.exeC:\Windows\system32\load.exe -bai C:\Users\Admin\AppData\Local\Temp\ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\load.exeC:\Windows\system32\load.exe -bai C:\Windows\SysWOW64\load.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\load.exeC:\Windows\system32\load.exe -bai C:\Windows\SysWOW64\load.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\load.exeC:\Windows\system32\load.exe -bai C:\Windows\SysWOW64\load.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\load.exeC:\Windows\system32\load.exe -bai C:\Windows\SysWOW64\load.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\load.exeC:\Windows\system32\load.exe -bai C:\Windows\SysWOW64\load.exe7⤵
- Executes dropped EXE
PID:3960
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
308KB
MD5ff3cc5b9d609c047b7eb0f717a372c48
SHA15f95da0e959faed4d23f2dda18230157751a0ad9
SHA2561fe647c8bf4be7c18ba4e65025ed7928829177b180ac23afab686e1898713097
SHA51231d81af2fdfc88a692d3d95c9c0af6286702130f0a653e3dbbdbd28244c902f476c4830305e9a90ad4e91f1d0cbaca005cf62280e4d50b6a0bb466dda6ec8b6b