Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 04:45
Static task
static1
Behavioral task
behavioral1
Sample
11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe
-
Size
2.4MB
-
MD5
11e2f3e322444d43bffbef8587164539
-
SHA1
29c00e5f107a91c8cb73d8f2b70c063614d908b2
-
SHA256
7c4a12f52a3eed59f3b7bd9598ddf8f0a241049900ed3310a69a8fb312346f9c
-
SHA512
7b51100f15e55a80b60e0d0c17c600a681cb43f2a2b9c13f635ccdc884b259c903053a6ec27999edef6e3f9789739a87da447df76c1692125f97da234ce3751d
-
SSDEEP
24576:lg8vc8eW1aQ8rWWdneuZLtObIL2/PEdqzICEFISO/c1Ev+fLA1Yz07nzBA2ho4kU:lTxeWWPlPZLziXEdSICdDv+lz071A2t
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\IESettingSync 11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4772 11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe 4772 11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe 4772 11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe 4772 11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11e2f3e322444d43bffbef8587164539_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5d65ec06f21c379c87040b83cc1abac6b
SHA1208d0a0bb775661758394be7e4afb18357e46c8b
SHA256a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
SHA5128a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e
-
Filesize
11KB
MD59234071287e637f85d721463c488704c
SHA1cca09b1e0fba38ba29d3972ed8dcecefdef8c152
SHA25665cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649
SHA51287d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384
-
Filesize
2KB
MD54bcfe9f8db04948cddb5e31fe6a7f984
SHA142464c70fc16f3f361c2419751acd57d51613cdf
SHA256bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228
SHA512bb0ef3d32310644285f4062ad5f27f30649c04c5a442361a5dbe3672bd8cb585160187070872a31d9f30b70397d81449623510365a371e73bda580e00eef0e4e