Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 12:27
Behavioral task
behavioral1
Sample
3fda62d225b996689370e49ace584024_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3fda62d225b996689370e49ace584024_JaffaCakes118.exe
-
Size
228KB
-
MD5
3fda62d225b996689370e49ace584024
-
SHA1
5ac51aaa9af6c28153c2c84b20580cfe576a2345
-
SHA256
19075bef02751617b806bed66352f791ab93cf456e4e4debd66f9d0adfadeab9
-
SHA512
b75090ea01d31df3c10e98bcc03ecf4a4ebfce4853d0592759cee8d0b51c212225d657461e4ca14dc93154daedb7f38ffc7e1ea5aad024354b6ffff55e6af390
-
SSDEEP
6144:zAmIhgpYy4c2+keFKEK7kmR/qszYX1932QVTH3jRVI6a:zVIhgpYR+keoAmRCsm9Zs
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 3fda62d225b996689370e49ace584024_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation ins8093.exe -
Executes dropped EXE 2 IoCs
pid Process 180 ins8093.exe 4000 ins.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini ins.exe File opened for modification C:\Windows\assembly\Desktop.ini ins.exe -
resource yara_rule behavioral2/memory/1468-0-0x0000000000B80000-0x0000000000BDE000-memory.dmp upx behavioral2/memory/1468-31-0x0000000000B80000-0x0000000000BDE000-memory.dmp upx behavioral2/memory/1468-38-0x0000000000B80000-0x0000000000BDE000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly ins.exe File created C:\Windows\assembly\Desktop.ini ins.exe File opened for modification C:\Windows\assembly\Desktop.ini ins.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fda62d225b996689370e49ace584024_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ins.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4000 ins.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4000 ins.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4000 ins.exe 4000 ins.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1468 wrote to memory of 180 1468 3fda62d225b996689370e49ace584024_JaffaCakes118.exe 85 PID 1468 wrote to memory of 180 1468 3fda62d225b996689370e49ace584024_JaffaCakes118.exe 85 PID 180 wrote to memory of 4000 180 ins8093.exe 88 PID 180 wrote to memory of 4000 180 ins8093.exe 88 PID 180 wrote to memory of 4000 180 ins8093.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fda62d225b996689370e49ace584024_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3fda62d225b996689370e49ace584024_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\ins8093\ins8093.exe"C:\Users\Admin\AppData\Local\Temp\ins8093\ins8093.exe" ins.exe /e10742466 /u52173bb8-0ed4-4c29-9d48-482f0a0000132⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:180 -
C:\Users\Admin\AppData\Local\Temp\ins8093\ins.exe"C:\Users\Admin\AppData\Local\Temp\ins8093\ins.exe" /e10742466 /u52173bb8-0ed4-4c29-9d48-482f0a0000133⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4000
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
253KB
MD5990774201cab9f23e9b2a4dbfd7b322d
SHA1a77b83a8a3b9efcc38e8b3d1c42e681c1450470c
SHA25668da632d702639815cc5875aefd103304c528df93bd8e197e7d6335787d131ae
SHA5121d15af0b2a44b23319ffe35164b285868a32cd7b2e5810bf97902d5f91891eaf6f8f6e182d0ca9e6090a670f768567a3f667a95451d93e9881734f0c8b2ebde5
-
Filesize
137KB
MD5658f4a04835c8522c64b73d478cb023d
SHA1c1ed730661467a430e41247d5518afeb25ca7f7d
SHA256d8e92455694e8d5cd8266221e5a536014b57df4169cb6793a5dabb0b42f0d781
SHA512c36ad5a49416f1dc0fa67068a106d120449ec3bb6e39a05e3730ca4cc982d6a7b01bbe7993ec74f3351223529ef3eb0a0df1f27180012ac21fadf5e2d953e1eb