Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
102s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe
-
Size
688KB
-
MD5
2a8c76c149b7b31f27e2533ecbba80bf
-
SHA1
2036898e4b4eb8a5740e1eb090f6ae61483c5fae
-
SHA256
b63b9ab36b8e6fcaf0c5455c09c76d4db231fdc0fe0077c227b9d61d4a6cd624
-
SHA512
f800af2deefa1f4cb620325c8046590ec48b3fb4240fc1bd660d7ee38646d8d451d75baf0a882b00a000ce2590c01824597d244586a3d7b7860ef0e29d19629e
-
SSDEEP
12288:6F0rjvmwGruGzL8LcKsgMxOYctIg5x4zs0XmVSu/nX1ns4t:6FYT4rnLWFMxnctIgcs0Xi/X6
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scanedisko07.dll rundll32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandisk.lnk rundll32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandisk.lnk 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandisk.lnk rundll32.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys reg.exe -
Loads dropped DLL 2 IoCs
pid Process 4184 rundll32.exe 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NvCplDaemonTool = "rundll32.exe C:\\Windows\\system32\\aloadlF8.dll,_IWMPEvents" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvCplDaemonTool = "rundll32.exe C:\\Users\\Admin\\aloadlF8.dll,_IWMPEvents" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NvCplDaemonTool = "rundll32.exe C:\\Windows\\system32\\aloadlF8.dll,_IWMPEvents" 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvCplDaemonTool = "rundll32.exe C:\\Users\\Admin\\aloadlF8.dll,_IWMPEvents" 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\aloadlF8.dll rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 6 IoCs
pid Process 1652 reg.exe 384 reg.exe 2904 reg.exe 4164 reg.exe 3876 reg.exe 4596 reg.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4184 rundll32.exe 4184 rundll32.exe 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4184 rundll32.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3868 wrote to memory of 4184 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 86 PID 3868 wrote to memory of 4184 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 86 PID 3868 wrote to memory of 4184 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 86 PID 3868 wrote to memory of 4596 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 87 PID 3868 wrote to memory of 4596 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 87 PID 3868 wrote to memory of 4596 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 87 PID 3868 wrote to memory of 1652 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 89 PID 3868 wrote to memory of 1652 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 89 PID 3868 wrote to memory of 1652 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 89 PID 3868 wrote to memory of 384 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 91 PID 3868 wrote to memory of 384 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 91 PID 3868 wrote to memory of 384 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 91 PID 3868 wrote to memory of 2904 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 93 PID 3868 wrote to memory of 2904 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 93 PID 3868 wrote to memory of 2904 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 93 PID 3868 wrote to memory of 4164 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 95 PID 3868 wrote to memory of 4164 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 95 PID 3868 wrote to memory of 4164 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 95 PID 3868 wrote to memory of 3876 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 96 PID 3868 wrote to memory of 3876 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 96 PID 3868 wrote to memory of 3876 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 96 PID 3868 wrote to memory of 4680 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 97 PID 3868 wrote to memory of 4680 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 97 PID 3868 wrote to memory of 4680 3868 2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\A7C9.tmp,_IWMPEvents2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4184
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" delete HKLM\System\CurrentControlSet\Control\Safeboot /f2⤵
- Impair Defenses: Safe Mode Boot
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4596
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" delete HKLM\System\ControlSet001\Control\Safeboot /f2⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1652
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" delete HKLM\System\ControlSet002\Control\Safeboot /f2⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:384
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings /v PrivacyAdvanced /t REG_DWORD /d 1 /f2⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2904
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 /v {A8A88C49-5EB2-4990-A1A2-0876022C854F} /t REG_BINARY /d 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a /f2⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4164
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 /v {AEBA21FA-782A-4A90-978D-B72164C80120} /t REG_BINARY /d 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a /f2⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3876
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2A8C76~1.EXE >> NUL2⤵
- System Location Discovery: System Language Discovery
PID:4680
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Indicator Removal
1File Deletion
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
580KB
MD5d9a94bb51481ebb656569f018bae0d6a
SHA1facb4322408b323483458ef44c9f6038460b2f25
SHA25614d5cbec3f0d8a0afadceabd40ff072c802598f0abdebf0ff4dea5dfd3931c06
SHA512f99c52250a4f69f329b23864f1a5fc09af5e659bf0822a0e18cf75ce421b6c1b85e2ab74b0c5ed8e29a73c37c7c92c18a2162259feb9c8dd64c4a3e6d1455736
-
Filesize
1KB
MD5f72ce4993ad6d29dbd32e99365ea5fe1
SHA1019b60f3ac7d6013d4d927183a2cdf1da0a51601
SHA256b07a8d94bcefc572e7e95e176e60d01788e301d90440b0ffde837c28a64dd0ec
SHA512e9a655daf6923c275955484c6b8f99da6bd89b3b86f5f7f2979e6173c638cbf0ab0b517fe35be54a4ef38881e2b50017391a49ef8617b54e8bbc3efb138f91d4