Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 13:18 UTC
Static task
static1
Behavioral task
behavioral1
Sample
40126767bf28d05e060d06c6233d4544_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
40126767bf28d05e060d06c6233d4544_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
40126767bf28d05e060d06c6233d4544_JaffaCakes118.exe
-
Size
165KB
-
MD5
40126767bf28d05e060d06c6233d4544
-
SHA1
6ecd6a4890cac261fba621756d2b1ab493e98361
-
SHA256
147b690a3b4eb0d6033e2394c55b019cc9e99b20c59dc22b892911e760aeaf4f
-
SHA512
21a439ae33c83e9fe1dd7023a943b695a8b3dd0b5ea70e95a47fe0cef53f77ff897c695a40dafa6273c50c1402d95a118ef7aa1ccca0dab0c861bc48b539ef32
-
SSDEEP
3072:y4HCWau/PlYeuL7ZLFh6Ca6cbL9l2hzB3fJCC6j8+Er6ez4:piI/PlY37ZLF4Ca6WABqBOvs
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 40126767bf28d05e060d06c6233d4544_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 536 ins8067.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini ins8067.exe File opened for modification C:\Windows\assembly\Desktop.ini ins8067.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly ins8067.exe File created C:\Windows\assembly\Desktop.ini ins8067.exe File opened for modification C:\Windows\assembly\Desktop.ini ins8067.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40126767bf28d05e060d06c6233d4544_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ins8067.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 536 ins8067.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 536 ins8067.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 536 ins8067.exe 536 ins8067.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3436 wrote to memory of 536 3436 40126767bf28d05e060d06c6233d4544_JaffaCakes118.exe 85 PID 3436 wrote to memory of 536 3436 40126767bf28d05e060d06c6233d4544_JaffaCakes118.exe 85 PID 3436 wrote to memory of 536 3436 40126767bf28d05e060d06c6233d4544_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\40126767bf28d05e060d06c6233d4544_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\40126767bf28d05e060d06c6233d4544_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\ins8067\ins8067.exe"C:\Users\Admin\AppData\Local\Temp\ins8067\ins8067.exe" ins.exe /e6293404 /u50d1d9d5-cf90-407c-820a-35e05bc06f2f2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:536
-
Network
-
Remote address:8.8.8.8:53Request68.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestapi.socdn.comIN AResponseapi.socdn.comIN CNAME615321.parkingcrew.net615321.parkingcrew.netIN A13.248.148.254615321.parkingcrew.netIN A76.223.26.96
-
Remote address:13.248.148.254:80RequestGET /installer/50d1d9d5-cf90-407c-820a-35e05bc06f2f/6293404/config HTTP/1.1
User-Agent: DownloadMR/3.0.21 (MSIE 9.11;Windows NT 6.2.9200.0;WOW64;.NET CLR 2.0.50727 SP2; .NET CLR 3.0 SP2; .NET CLR 3.5 SP1; .NET CLR 4; .NET CLR 4.0;m=B660M GAMING X DDR4;northstar)
Accept-Language: en-US
Host: api.socdn.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Accept-Ch: dpr
Accept-Ch: device-memory
Accept-Ch: rtt
Accept-Ch: downlink
Accept-Ch: ect
Accept-Ch: ua
Accept-Ch: ua-full-version
Accept-Ch: ua-platform
Accept-Ch: ua-platform-version
Accept-Ch: ua-arch
Accept-Ch: ua-model
Accept-Ch: ua-mobile
Accept-Ch-Lifetime: 30
Content-Type: text/html; charset=UTF-8
Date: Sun, 13 Oct 2024 13:18:59 GMT
Server: Caddy
Server: nginx
Vary: Accept-Encoding
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_rOmv83cr1AAqEX9JHoqHLGPvNJ4QcRn7CbnQ1ZwgNA43nHttjN6T09HzAnTmit1+gX6iV/ZBuo9vkwz9hiHicA==
X-Buckets: bucket102
X-Domain: socdn.com
X-Language: english
X-Pcrew-Blocked-Reason: hosting network
X-Pcrew-Ip-Organization: Datacamp
X-Redirect: skenzo
X-Subdomain: api
X-Template: tpl_CleanPeppermintBlack_twoclick
Transfer-Encoding: chunked
-
Remote address:13.248.148.254:80RequestPOST /installer/50d1d9d5-cf90-407c-820a-35e05bc06f2f/6293404/event HTTP/1.1
User-Agent: DownloadMR/3.0.21 (MSIE 9.11;Windows NT 6.2.9200.0;WOW64;.NET CLR 2.0.50727 SP2; .NET CLR 3.0 SP2; .NET CLR 3.5 SP1; .NET CLR 4; .NET CLR 4.0;m=B660M GAMING X DDR4;northstar)
Accept-Language: en-US
Content-Type: application/x-www-form-urlencoded
Host: api.socdn.com
Content-Length: 3393
Expect: 100-continue
ResponseHTTP/1.1 100 Continue
-
Remote address:13.248.148.254:80ResponseHTTP/1.1 200 OK
Accept-Ch: dpr
Accept-Ch: device-memory
Accept-Ch: rtt
Accept-Ch: downlink
Accept-Ch: ect
Accept-Ch: ua
Accept-Ch: ua-full-version
Accept-Ch: ua-platform
Accept-Ch: ua-platform-version
Accept-Ch: ua-arch
Accept-Ch: ua-model
Accept-Ch: ua-mobile
Accept-Ch-Lifetime: 30
Content-Type: text/html; charset=UTF-8
Date: Sun, 13 Oct 2024 13:19:00 GMT
Server: Caddy
Server: nginx
Vary: Accept-Encoding
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_cnRMFzbldgJHJukTToWoqkVRUIbDeU0MeZLsPD7zt6soFMxKkouutwU2U4G7u0bkRXNVVtRP34JzT4Cq8o2b9A==
X-Buckets: bucket102
X-Domain: socdn.com
X-Language: english
X-Pcrew-Blocked-Reason: hosting network
X-Pcrew-Ip-Organization: Datacamp
X-Redirect: skenzo
X-Subdomain: api
X-Template: tpl_CleanPeppermintBlack_twoclick
Transfer-Encoding: chunked
-
Remote address:8.8.8.8:53Request254.148.248.13.in-addr.arpaIN PTRResponse254.148.248.13.in-addr.arpaIN PTRaba1c1ff9d2ec5376awsglobalacceleratorcom
-
Remote address:8.8.8.8:53Request200.163.202.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.209.201.84.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
13.248.148.254:80http://api.socdn.com/installer/50d1d9d5-cf90-407c-820a-35e05bc06f2f/6293404/eventhttpins8067.exe4.8kB 7.3kB 15 17
HTTP Request
GET http://api.socdn.com/installer/50d1d9d5-cf90-407c-820a-35e05bc06f2f/6293404/configHTTP Response
200HTTP Request
POST http://api.socdn.com/installer/50d1d9d5-cf90-407c-820a-35e05bc06f2f/6293404/eventHTTP Response
100HTTP Response
200
-
72 B 158 B 1 1
DNS Request
68.159.190.20.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
43.58.199.20.in-addr.arpa
-
59 B 127 B 1 1
DNS Request
api.socdn.com
DNS Response
13.248.148.25476.223.26.96
-
73 B 129 B 1 1
DNS Request
254.148.248.13.in-addr.arpa
-
74 B 160 B 1 1
DNS Request
200.163.202.172.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
73 B 133 B 1 1
DNS Request
103.209.201.84.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
43.229.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257KB
MD5ae117f47bd80e5dcf72cf81347fceb73
SHA11cd3e4c5fc9fb317b7a8eae6c94d53078800b635
SHA25649b0ec8a4000cb30f15b318bef4b6f59be2d0f7365be4c4b2b4fd5607e16e23c
SHA51272d322ec9b13e9ede1967707129f2941328ec75487aa5ea205eab0780ef26c33f253204ce08932052a6ed19d13bd62e68b4f795ef17717b9f31e5a76a9f0c16f