Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 05:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe
-
Size
265KB
-
MD5
0e34d858cbadee35bc949cfeee383d14
-
SHA1
7149f3a682b91725dbe2faf23d238ad0aebbaf83
-
SHA256
02e069ecbeba24019bbdeb0fb4c425336ccd5c49165fd67b43b29221f8dbcd29
-
SHA512
f6e9eff79044cc8dd52afb383e9c0069d4da0b728b9c99c34c0efed0fcda0b908aa514e436bf41b1d759d2894dbbc6486d0aa19ec0ccc2763bf414532d898271
-
SSDEEP
6144:3c+Sbnb19PqT/nfYluOtgyNKF5EKok5gDOK:uZd+H/OKyNA5TL5g6
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\CE8SIIFGSU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe" 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe File opened for modification C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe 2488 0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4276 wrote to memory of 4308 4276 taskeng.exe 33 PID 4276 wrote to memory of 4308 4276 taskeng.exe 33 PID 4276 wrote to memory of 4308 4276 taskeng.exe 33 PID 4276 wrote to memory of 4308 4276 taskeng.exe 33 PID 4276 wrote to memory of 4308 4276 taskeng.exe 33 PID 4276 wrote to memory of 4308 4276 taskeng.exe 33 PID 4276 wrote to memory of 4308 4276 taskeng.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2488
-
C:\Windows\system32\taskeng.exetaskeng.exe {A52EE829-735A-4771-9D93-7B5DAEE6E0CD} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0e34d858cbadee35bc949cfeee383d14_JaffaCakes118.exe2⤵
- System Location Discovery: System Language Discovery
PID:4308
-