Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 12:59
Behavioral task
behavioral1
Sample
05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe
-
Size
83KB
-
MD5
05e8b73312abcd84efc80394f2222d02
-
SHA1
2961107aa597d2c276d1355048118cd1c973b18b
-
SHA256
712f0c99f90ea9cc9caa04e82e80b4e8d1ae896b66833628f8d5d77b39d99930
-
SHA512
718606ad5750fb1c0e835a262c631313bfadc38cdd2a6bedf3e0489635f1751257e3e8633c0c3ef06b43611878d23b73fa771ef95e4b2ff1ea37a8bab116ee74
-
SSDEEP
1536:6wKKva3L9Q3N1s/B/gjHAl4wS1rILJrA4f4bAgL+CSGRQbg:6wLvab9GHsJ/54wSt0HCVLFl
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8970.lnk explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 1364 explorer.exe -
Loads dropped DLL 2 IoCs
pid Process 1364 explorer.exe 1364 explorer.exe -
Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\y: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\v: explorer.exe File opened (read-only) \??\r: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\t: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\m: explorer.exe File opened (read-only) \??\m: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\o: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\p: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\z: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\e: explorer.exe File opened (read-only) \??\l: explorer.exe File opened (read-only) \??\n: explorer.exe File opened (read-only) \??\o: explorer.exe File opened (read-only) \??\r: explorer.exe File opened (read-only) \??\y: explorer.exe File opened (read-only) \??\k: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\j: explorer.exe File opened (read-only) \??\s: explorer.exe File opened (read-only) \??\h: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\q: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\h: explorer.exe File opened (read-only) \??\i: explorer.exe File opened (read-only) \??\k: explorer.exe File opened (read-only) \??\p: explorer.exe File opened (read-only) \??\x: explorer.exe File opened (read-only) \??\v: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\x: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\e: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\s: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\w: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\u: explorer.exe File opened (read-only) \??\z: explorer.exe File opened (read-only) \??\g: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\i: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\j: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\n: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\u: 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened (read-only) \??\g: explorer.exe File opened (read-only) \??\q: explorer.exe File opened (read-only) \??\t: explorer.exe File opened (read-only) \??\w: explorer.exe -
resource yara_rule behavioral2/memory/3112-0-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/files/0x0008000000023450-3.dat upx behavioral2/memory/3112-28-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-35-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-39-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-41-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-43-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-45-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-47-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-49-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-51-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-53-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-55-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-57-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-59-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-61-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1364-63-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\uiui8.dll explorer.exe File created C:\Program Files (x86)\Common Files\uiui8.dll explorer.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3112 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe 3112 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeLoadDriverPrivilege 3112 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1364 explorer.exe Token: SeDebugPrivilege 1364 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1364 explorer.exe 1364 explorer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3112 wrote to memory of 1364 3112 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe 82 PID 3112 wrote to memory of 1364 3112 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe 82 PID 3112 wrote to memory of 1364 3112 05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05e8b73312abcd84efc80394f2222d02_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1364
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD505e8b73312abcd84efc80394f2222d02
SHA12961107aa597d2c276d1355048118cd1c973b18b
SHA256712f0c99f90ea9cc9caa04e82e80b4e8d1ae896b66833628f8d5d77b39d99930
SHA512718606ad5750fb1c0e835a262c631313bfadc38cdd2a6bedf3e0489635f1751257e3e8633c0c3ef06b43611878d23b73fa771ef95e4b2ff1ea37a8bab116ee74
-
Filesize
17KB
MD590b1f2289c3121611de1b47a54803e38
SHA18c1a78e9e777072aa60c365feb94b4eaee93ee8a
SHA25628267ad6e645fd72dcb1a218b709c85bcbe34ebb5468f9533b04ff34d7647e0c
SHA512216423e0647d4e40df227cb1bc6b6efddd2e84f5e9a58048219d7e59ec61f46e43e5e47bc4ea4485ef7af6282052113b0e68b73655c3245ec48d826fb8d905d6
-
Filesize
449B
MD5ae342318b288719168082ba3f26d8e33
SHA10464e616edc87b677de3e514a5e5baf696ac92ec
SHA256331939a00efce9cab0dc7e690b7be7de0e3d2378f7ea48640bc80ead177332ec
SHA5122e7d224df58bdc39395208fae51726c6d7eff76752c1fdc746da3294b159c1b6fbc9440354ff935c41b2d18d6734cfcc6c18fb726b78fc7d73d870a32cebda34