Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2024, 07:40
Static task
static1
Behavioral task
behavioral1
Sample
0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe
-
Size
156KB
-
MD5
0034f1212179755bc4d28a3f4792afca
-
SHA1
1bd974f713fbc6ed070e32ef4745480a385af408
-
SHA256
cc00e8e28446453d64e011931374e528534ffd90b97ab949fddf9c0e4fbf43f0
-
SHA512
178e486abfd863d0559608cf0bc9ab10c82778afd1e7552f37b22614848e1e77d703f963eb3bf0f80ca5d99d9893905fea1560454adc1e28c62633968aa2838f
-
SSDEEP
3072:YD1Yk6XEp2j+dneHR0vL5Ed6ybSTkYOgxT5NDXBpX8vaa:Y2kmwneHa5Ed6GrYOgDjpM
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2100 Vygagv.exe 1896 Vygagv.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vygagv = "C:\\Users\\Admin\\AppData\\Roaming\\Vygagv.exe" 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1640 set thread context of 5008 1640 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 82 PID 2100 set thread context of 1896 2100 Vygagv.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vygagv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vygagv.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "507242273" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31134476" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "507242273" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434447014" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{49D983A3-7EFF-11EF-939B-EE255DF7DB21} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "510055116" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31134476" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31134476" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5008 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 5008 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1896 Vygagv.exe Token: SeDebugPrivilege 2284 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2628 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1640 wrote to memory of 5008 1640 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 82 PID 1640 wrote to memory of 5008 1640 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 82 PID 1640 wrote to memory of 5008 1640 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 82 PID 1640 wrote to memory of 5008 1640 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 82 PID 1640 wrote to memory of 5008 1640 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 82 PID 1640 wrote to memory of 5008 1640 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 82 PID 1640 wrote to memory of 5008 1640 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 82 PID 1640 wrote to memory of 5008 1640 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 82 PID 1640 wrote to memory of 5008 1640 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 82 PID 5008 wrote to memory of 2100 5008 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 87 PID 5008 wrote to memory of 2100 5008 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 87 PID 5008 wrote to memory of 2100 5008 0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe 87 PID 2100 wrote to memory of 1896 2100 Vygagv.exe 88 PID 2100 wrote to memory of 1896 2100 Vygagv.exe 88 PID 2100 wrote to memory of 1896 2100 Vygagv.exe 88 PID 2100 wrote to memory of 1896 2100 Vygagv.exe 88 PID 2100 wrote to memory of 1896 2100 Vygagv.exe 88 PID 2100 wrote to memory of 1896 2100 Vygagv.exe 88 PID 2100 wrote to memory of 1896 2100 Vygagv.exe 88 PID 2100 wrote to memory of 1896 2100 Vygagv.exe 88 PID 2100 wrote to memory of 1896 2100 Vygagv.exe 88 PID 1896 wrote to memory of 3952 1896 Vygagv.exe 90 PID 1896 wrote to memory of 3952 1896 Vygagv.exe 90 PID 1896 wrote to memory of 3952 1896 Vygagv.exe 90 PID 3952 wrote to memory of 2628 3952 iexplore.exe 91 PID 3952 wrote to memory of 2628 3952 iexplore.exe 91 PID 2628 wrote to memory of 2284 2628 IEXPLORE.EXE 92 PID 2628 wrote to memory of 2284 2628 IEXPLORE.EXE 92 PID 2628 wrote to memory of 2284 2628 IEXPLORE.EXE 92 PID 1896 wrote to memory of 2284 1896 Vygagv.exe 92 PID 1896 wrote to memory of 2284 1896 Vygagv.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0034f1212179755bc4d28a3f4792afca_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Roaming\Vygagv.exe"C:\Users\Admin\AppData\Roaming\Vygagv.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Roaming\Vygagv.exe"C:\Users\Admin\AppData\Roaming\Vygagv.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:17410 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2284
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5d08423737246250d0c3c50ea390cd1c4
SHA15b48dab1d90ac5357dafd6ad8b6990da92aaf75a
SHA2567714ff60052145ab9a2bdd947fbbec0572c02389256b2db314f2670764862789
SHA51267f5c7e7078f4fb5216b91b31e6b38c5497324413f8fc79cd662cad952a808453289b3ef2226fa377812bfc93697f11e5d6e064dc0e5f80b1a6b15dc516eb10e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD58241ac48d15ac87d2e82895c9f0ab3f9
SHA136497acd0eb18694f1fac2251eeb9fc8c6c5bc17
SHA256dbc4c1aaae143e42bbdbb68dae0c38a8866c4239c544d1532bc9cb12aee363e7
SHA5128de38d0975bc86a38ac4e5a71d77350c95f0f5a746bea65f459f66de565b2bbc4975655661e12edbaf4e77560759343fd47484f78f4520e57deb278a7ed55697
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
156KB
MD50034f1212179755bc4d28a3f4792afca
SHA11bd974f713fbc6ed070e32ef4745480a385af408
SHA256cc00e8e28446453d64e011931374e528534ffd90b97ab949fddf9c0e4fbf43f0
SHA512178e486abfd863d0559608cf0bc9ab10c82778afd1e7552f37b22614848e1e77d703f963eb3bf0f80ca5d99d9893905fea1560454adc1e28c62633968aa2838f