Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 06:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe
-
Size
146KB
-
MD5
38e961ac644b57fa0588e4907ea14271
-
SHA1
9d3d6f3bf2a29b8dde7d615e62efb63c45178e3d
-
SHA256
9410995f6a038b9e3ccaaf27f8c572a063f1986ee2624f43f94c9006ea1ebbc4
-
SHA512
90103006dbb0c2444a3028a0cdc4e9c514da113cbc55e0455653ee2a5d9d6f75b437d60fb9275dcbbeb30c80e46238e00664c2276fac9e69fe6326e479731622
-
SSDEEP
3072:XX78TyX8zuj6MCEmVChZUIVBM9wb8Nj8l4Qb3IjHqGB8lCZBte/SHWfRgN:axqxyIH+w5b38B8lCduS2fRgN
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 5000 iexplore.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\srvsgdns = "\"C:\\Users\\Admin\\AppData\\Roaming\\srvsgdns.exe\" -autorun" iexplore.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3092 set thread context of 4464 3092 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4464 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3092 wrote to memory of 4464 3092 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 86 PID 3092 wrote to memory of 4464 3092 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 86 PID 3092 wrote to memory of 4464 3092 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 86 PID 3092 wrote to memory of 4464 3092 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 86 PID 3092 wrote to memory of 4464 3092 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 86 PID 3092 wrote to memory of 4464 3092 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 86 PID 3092 wrote to memory of 4464 3092 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 86 PID 3092 wrote to memory of 4464 3092 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 86 PID 3092 wrote to memory of 4464 3092 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 86 PID 3092 wrote to memory of 4464 3092 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 86 PID 3092 wrote to memory of 4464 3092 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 86 PID 4464 wrote to memory of 5000 4464 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 87 PID 4464 wrote to memory of 5000 4464 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 87 PID 4464 wrote to memory of 5000 4464 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 87 PID 4464 wrote to memory of 5000 4464 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 87 PID 4464 wrote to memory of 5000 4464 38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe 87 PID 5000 wrote to memory of 3496 5000 iexplore.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\38e961ac644b57fa0588e4907ea14271_JaffaCakes118.exe"3⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Deletes itself
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5000
-
-
-