Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 17:38
Static task
static1
Behavioral task
behavioral1
Sample
3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe
-
Size
28KB
-
MD5
3b4465726cc08d05f1e34fab4afa300d
-
SHA1
c71e0f60bae2897da07838381c620e2f9bfefc1d
-
SHA256
05a7a4c2e20735ca3823ff57b83fb7dca58cd2ee9c8f8a4769bed9385cae6755
-
SHA512
a0e383d95bc81f407976b0fc9948133171bf754d92090241dad51507494cf36f59b460f17d04c3428adf1d14daf27a648caa2cf05ec94922abc6eee1858948e4
-
SSDEEP
384:YB360vym2ZWCSkxpTT6kOiu98z53JSDKTq7PQ:8Xym2RHT6BiHjgKTKPQ
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A47BE134-9ACE-2457-ABD0-3AE14579BDE1} 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A47BE134-9ACE-2457-ABD0-3AE14579BDE1}\StubPath = "C:\\Windows\\system32\\BHOCALL.EXE" 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 312 BHOCALL.EXE -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\BHOCALL.EXE 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\BHOCALL.EXE 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BHOCALL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3904 PING.EXE 2376 cmd.exe 4496 PING.EXE 5032 cmd.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command BHOCALL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage BHOCALL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell BHOCALL.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID BHOCALL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} BHOCALL.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings OpenWith.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 4496 PING.EXE 3904 PING.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4372 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe Token: SeDebugPrivilege 312 BHOCALL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 220 OpenWith.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4372 wrote to memory of 5032 4372 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe 85 PID 4372 wrote to memory of 5032 4372 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe 85 PID 4372 wrote to memory of 5032 4372 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe 85 PID 5032 wrote to memory of 3904 5032 cmd.exe 87 PID 5032 wrote to memory of 3904 5032 cmd.exe 87 PID 5032 wrote to memory of 3904 5032 cmd.exe 87 PID 5032 wrote to memory of 312 5032 cmd.exe 89 PID 5032 wrote to memory of 312 5032 cmd.exe 89 PID 5032 wrote to memory of 312 5032 cmd.exe 89 PID 312 wrote to memory of 2376 312 BHOCALL.EXE 90 PID 312 wrote to memory of 2376 312 BHOCALL.EXE 90 PID 312 wrote to memory of 2376 312 BHOCALL.EXE 90 PID 2376 wrote to memory of 4496 2376 cmd.exe 93 PID 2376 wrote to memory of 4496 2376 cmd.exe 93 PID 2376 wrote to memory of 4496 2376 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 &del 3b4465726cc08d05f1e34fab4afa300d_JaffaCakes118.exe &start BHOCALL.EXE2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 33⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3904
-
-
C:\Windows\SysWOW64\BHOCALL.EXEBHOCALL.EXE3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Windows\SysWOW64\cmd.execmd /c if exist C:\Users\Admin\AppData\Local\Temp\\~C41B.tmp start C:\Users\Admin\AppData\Local\Temp\\~C41B.tmp&ping 127.0.0.1 -n 20&if exist C:\Users\Admin\AppData\Local\Temp\\~C41B.tmp del C:\Users\Admin\AppData\Local\Temp\\~C41B.tmp4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 205⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4496
-
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD53b4465726cc08d05f1e34fab4afa300d
SHA1c71e0f60bae2897da07838381c620e2f9bfefc1d
SHA25605a7a4c2e20735ca3823ff57b83fb7dca58cd2ee9c8f8a4769bed9385cae6755
SHA512a0e383d95bc81f407976b0fc9948133171bf754d92090241dad51507494cf36f59b460f17d04c3428adf1d14daf27a648caa2cf05ec94922abc6eee1858948e4