Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 15:30
Static task
static1
Behavioral task
behavioral1
Sample
40a2abd2611d198acd708cd37fa1373c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
40a2abd2611d198acd708cd37fa1373c_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
40a2abd2611d198acd708cd37fa1373c_JaffaCakes118.exe
-
Size
35KB
-
MD5
40a2abd2611d198acd708cd37fa1373c
-
SHA1
803fcf9986e45851cc61cbdc9942eb10b1be7a97
-
SHA256
dc54c641c415c23c93da046eb314c746fcca5f82cd8a56970c1ebc4fabba1b16
-
SHA512
4bddd5515de541216b337f461c5e3481d7df383a1bf1d7b27e34ae0f5065d18df203bb585bd7563dea83bebad5939de1860f824cefc089032f7546fdc69a578a
-
SSDEEP
768:NqQoj/dSzNVQ1mDNJWbKEdBMQXQ3Cn4eQQDrcwxE:MQoj/YNJcAQDk
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 40a2abd2611d198acd708cd37fa1373c_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4004 jusched.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Java\jre-19\bin\jusched.exe 40a2abd2611d198acd708cd37fa1373c_JaffaCakes118.exe File created C:\Program Files (x86)\Java\jre-19\bin\UF 40a2abd2611d198acd708cd37fa1373c_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40a2abd2611d198acd708cd37fa1373c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe 4004 jusched.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4728 wrote to memory of 4004 4728 40a2abd2611d198acd708cd37fa1373c_JaffaCakes118.exe 86 PID 4728 wrote to memory of 4004 4728 40a2abd2611d198acd708cd37fa1373c_JaffaCakes118.exe 86 PID 4728 wrote to memory of 4004 4728 40a2abd2611d198acd708cd37fa1373c_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\40a2abd2611d198acd708cd37fa1373c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\40a2abd2611d198acd708cd37fa1373c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Program Files (x86)\Java\jre-19\bin\jusched.exe"C:\Program Files (x86)\Java\jre-19\bin\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
35KB
MD50fad27082073212e7a9c36eb71e47c40
SHA192e25b4cc15166d775874f8ef90628f00afaad39
SHA256c1980814d22847b8d7ef4b72ede7526960b296bafa7df588a2c919e227675d85
SHA512d5d758ab428dc1b41cbaba4c594df41d0657496a0d9d857b158b91e576502171c3cdff2a2d1399f58dde720e94d8320bd7e1beb8830f043c312f34aaa5075024