Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 10:34
Behavioral task
behavioral1
Sample
17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe
-
Size
298KB
-
MD5
17bc9d68f4301f99b07102691af79a36
-
SHA1
af0025d775ba5a0bc72b941cd070b53fe56d8573
-
SHA256
b47b053610f8d6e29d2f86350fab58a2f1b5b315d3b2b6eb8a9b0f9a6fbff5b8
-
SHA512
8f3ed78ea26ba0cd5bddac791f6f90dc39de2417c6d6aa5c7a9f456ca536f63075067510bec5d94fc547b81daa66ca4d627828d4cd4ea5b5897116c71daa3a83
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYK:v6Wq4aaE6KwyF5L0Y2D1PqL1
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 744 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\m: svhost.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3692-778-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-1130-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-1131-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-2260-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-3406-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-4547-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-5680-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-6821-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-7959-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-9092-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-10233-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-11372-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-12506-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-13638-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-14779-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/744-15800-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/3692-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x000900000002341f-4.dat upx behavioral2/files/0x0007000000023443-122.dat upx behavioral2/memory/3692-778-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-1130-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-1131-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-2260-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-3406-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-4547-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-5680-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-6821-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-7959-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-9092-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-10233-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-11372-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-12506-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-13638-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-14779-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/744-15800-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 744 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe 744 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3692 wrote to memory of 744 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 82 PID 3692 wrote to memory of 744 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 82 PID 3692 wrote to memory of 744 3692 17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\17bc9d68f4301f99b07102691af79a36_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD5647706fae8ef117fb7d802a7ccd012f4
SHA1b198b5111b4233bd64159719782240bc5c56f648
SHA256b055bc7c0e04b0bebd9c88393d743d1ba3478287bc8030c4141bc937827815d0
SHA512ff26429d64fa640dac98eb29c59b9be33cb5912bfcbc8e21efff101bde405f3e9b732cf1d7762b04da8bc07e70cef8f0524c59460d1c1720589d6f8961561ada
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD50013985bc62c2becf251cd9f212d9784
SHA1eb6827e481d75a64cf5ab3048095e1aecffc097f
SHA256fcb1eb464d0c7ecd254bff60f3bc144fe1a821bf1e5ffd93e0e4e4a750e1f03b
SHA512b7bb45102e04ec52492aed0e327d4774c3def131a3d23ef17424233ed6120890c1beca75acce82238c7c0fb0419d0cc03739c40ff3a3e5ea5c34194701de93cb