Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 08:44
Behavioral task
behavioral1
Sample
3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe
-
Size
842KB
-
MD5
3ee13e00d0b623c09b89d19b24abbb9d
-
SHA1
a6939a9c70a1a1e2538ad0bc4ea3bcc46034dd13
-
SHA256
6da30cea65053c5ed0977303b4625415db3a6e09402f23a2e9cf1d53765e586e
-
SHA512
b0cdba354c6d1dc38e2c44a6620e5ef8cdfabc655427a28e798c122537bdb2a31716e73b877f73f7f02d49db8231308b14ca792348cfe73fddde7f531af2ebcf
-
SSDEEP
24576:Bmo7tkQ0Ycb4FZ6cQkGklIpop6w9bZsKVjd:Yo7/0YcbjRkGklyNwDv7
Malware Config
Signatures
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
resource yara_rule behavioral2/memory/2156-0-0x0000000000400000-0x00000000008A0000-memory.dmp upx behavioral2/memory/2156-2-0x0000000000400000-0x00000000008A0000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 2956 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2956 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2156 3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe 2156 3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2156 wrote to memory of 1040 2156 3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe 84 PID 2156 wrote to memory of 1040 2156 3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe 84 PID 2156 wrote to memory of 1040 2156 3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe 84 PID 2156 wrote to memory of 1032 2156 3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe 85 PID 2156 wrote to memory of 1032 2156 3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe 85 PID 2156 wrote to memory of 1032 2156 3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe 85 PID 1040 wrote to memory of 2956 1040 cmd.exe 88 PID 1040 wrote to memory of 2956 1040 cmd.exe 88 PID 1040 wrote to memory of 2956 1040 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im QQ.exe /t2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im QQ.exe /t3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del 3ee13e00d0b623c09b89d19b24abbb9d_JaffaCakes118.exe2⤵
- System Location Discovery: System Language Discovery
PID:1032
-