Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02/11/2024, 17:18
General
-
Target
869e516b99f01a39f9ee0aa9e404fcbf_JaffaCakes118.exe
-
Size
334KB
-
MD5
869e516b99f01a39f9ee0aa9e404fcbf
-
SHA1
c31624e5da2efa21bf15aad89d135c996a72365f
-
SHA256
a9b1cf763a44f0cd8f59ff3178b19544216dc482aa47bbc7b83b5b26eda5e6aa
-
SHA512
78494b86022d9efb9eea3e98daa5d6a88c52fe23a07f0bc9435057f7382b846f82121b6764644f475b77ae4843259ffc7ef5a20660137c51a903dec33b1aac7c
-
SSDEEP
6144:Taa7bHF1Xe4xpNi+w+iEc/HXCO595ZZol+4NuTDid9LRyrlZZ:TfnXe47g+3iEc/SO595ZgUad9LRaZZ
Malware Config
Signatures
-
Contacts a large (16403) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 1 IoCs
-
Modifies Control Panel 4 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\869e516b99f01a39f9ee0aa9e404fcbf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\869e516b99f01a39f9ee0aa9e404fcbf_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{B965DA44-BA2B-5232-B6E1-2553B5BB2851}\autoconv.exe"C:\Users\Admin\AppData\Roaming\{B965DA44-BA2B-5232-B6E1-2553B5BB2851}\autoconv.exe"2⤵
- Adds policy Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "869e516b99f01a39f9ee0aa9e404fcbf_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\869e516b99f01a39f9ee0aa9e404fcbf_JaffaCakes118.exe" > NUL2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "869e516b99f01a39f9ee0aa9e404fcbf_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5543f288fdaf0126dd66112a1d24949bc
SHA191f5297f85efcc8ad379998f48c857105eff057b
SHA256fc1848824735efb94d1e761e2f7618f3a96b0b4b54cc2cba647f905ad129dae3
SHA5128af58ce7ba965f20787d470f46cc46a6164ff65c07b57f172237614b5c0ee1f5a1264c72704d34a9a4bd35ef2a2a5a7a9d95c760356094e456a2fda376cf70e3
-
Filesize
334KB
MD5869e516b99f01a39f9ee0aa9e404fcbf
SHA1c31624e5da2efa21bf15aad89d135c996a72365f
SHA256a9b1cf763a44f0cd8f59ff3178b19544216dc482aa47bbc7b83b5b26eda5e6aa
SHA51278494b86022d9efb9eea3e98daa5d6a88c52fe23a07f0bc9435057f7382b846f82121b6764644f475b77ae4843259ffc7ef5a20660137c51a903dec33b1aac7c
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB