Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 12:55
Behavioral task
behavioral1
Sample
182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe
-
Size
298KB
-
MD5
182b2b9a203df0f6ccb0454f9a83e73a
-
SHA1
f257012bef6576aacf81b1d4e6c61b707773ae97
-
SHA256
a9b33c9c466b5ed4f77aef2b78f014f78d8c5809ef26563c0464f91e4c3286df
-
SHA512
09f21bc67f321367b72f84ef877b781501f14619d5cf4be3d549d2a2bb3e3b9d4a496d1b023d3c17e54b99cf08f0b17ab8002cc1f7efc5e38f1bc53bfc9637e5
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYA:v6Wq4aaE6KwyF5L0Y2D1PqLB
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 388 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\z: svhost.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3892-766-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-1129-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-1131-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-2255-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-3401-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-4536-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-5668-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-6815-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-7955-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-9088-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-10232-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-11371-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-12504-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-13526-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-14666-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/388-15807-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/3892-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x0009000000022705-4.dat upx behavioral2/files/0x00070000000234f8-122.dat upx behavioral2/memory/3892-766-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-1129-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-1131-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-2255-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-3401-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-4536-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-5668-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-6815-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-7955-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-9088-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-10232-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-11371-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-12504-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-13526-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-14666-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/388-15807-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 388 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe 388 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3892 wrote to memory of 388 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 82 PID 3892 wrote to memory of 388 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 82 PID 3892 wrote to memory of 388 3892 182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\182b2b9a203df0f6ccb0454f9a83e73a_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD5c0398eae9193e39fe72114ff318b0c3d
SHA18a51a2097142e680fa71c2ac85869fcbd14aadf6
SHA2560f84fa1993563a966375b2fb663b9615575e4de0dc5d74fa3224c81f40f3ea37
SHA512da61c4c1d9acc7ff4202d74b4c587b212b7c5c452cf8f8706659caec91dc6f5a459b83ff8dd15098579ee276bfc708a5f3fb7bbccd67f9d8e75970c6243257fa
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD56d64006d35d93cc0cc72c41f90a34a11
SHA113006db77fb3dba679629f02672e1011e87d8869
SHA2565d31c913179ca48bf592a046d7d18357b9e06c73c49a9dbd8844a9c040d5bac6
SHA5124b284422348979a4a4acb2981294d90d161ba053ff240e6b180eb9ce72f36b04d4c560fd153b26c9a2cd77e0fbe838416ae6ef314f9971408df557c7cd5f63b0