Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 13:41
Static task
static1
Behavioral task
behavioral1
Sample
13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe
-
Size
21KB
-
MD5
13947bbce3ddefc0a0c3417f94d0bab1
-
SHA1
997e55c7241af0b4c51293a1bd465e856d295e69
-
SHA256
b4f8d885eef1e8878749470c5bd290dd740404fdaa3bc5ab2af9f76f8cb4d397
-
SHA512
b350bf1d9ab9d5b5dd831ab2ef31dd53816afd830a8108d871c88ab4c0d6a1b97fa2cf9f78e843ea2a7d78ecb51222bf7f35f6c85b96834d5e9e95c3e0ebff6f
-
SSDEEP
384:tQeC1XxcmEPX2UNUcHHynyrS7drJaKiw80sOrMgW5KNB/ryD:mNhcmK28SnyGXaKtXePD
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1316 cmd.exe 5036 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 4928 taskkill.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.IE\ = "IE" 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0" 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.IE 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\ = "????" 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE " 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5036 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Token: SeDebugPrivilege 4928 taskkill.exe Token: SeDebugPrivilege 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Token: SeDebugPrivilege 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Token: SeDebugPrivilege 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe Token: SeDebugPrivilege 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2160 wrote to memory of 4928 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe 81 PID 2160 wrote to memory of 4928 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe 81 PID 2160 wrote to memory of 4928 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe 81 PID 2160 wrote to memory of 1316 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe 84 PID 2160 wrote to memory of 1316 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe 84 PID 2160 wrote to memory of 1316 2160 13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe 84 PID 1316 wrote to memory of 5036 1316 cmd.exe 86 PID 1316 wrote to memory of 5036 1316 cmd.exe 86 PID 1316 wrote to memory of 5036 1316 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe"1⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ZhuDongFangyu.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 1 && del "C:\Users\Admin\AppData\Local\Temp\13947bbce3ddefc0a0c3417f94d0bab1_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5036
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1