Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2025, 12:23
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe
-
Size
457KB
-
MD5
54ef2f2acdf62dfb40fc32aab1f46307
-
SHA1
3f3640685b7af5b52a13d49cfd1cf5364114e317
-
SHA256
f384ded729fd7bf92383bf1ee12b4e3da92fbb01ef0e9d84bf439ba70525210d
-
SHA512
3ee12f2d99ce1ce272f99b7e190694f52aaf68bb2267f53efb6073d79100a3d127ad841bd9324d675af527e06bb9c56218ff1e91dfb644af1d21042cf049ff03
-
SSDEEP
6144:MqTi59VJdaD70ylbBTpVg8DPmgQhSdj/4KngWIq6jRk+j:MGin670yTTpVg8CgcSKKngWIjX
Malware Config
Extracted
formbook
3.9
h37
misfitsbarandgrill.com
pijpsletjes.com
practiman.com
trailersgeek.online
greathappiness.faith
solderisland.com
kk5299.com
nani21.com
sharpactinvest.com
meteocockpit.com
provisionswpgroup.com
theplaze.net
westaustralian.ninja
freetrafficupgradingall.win
paraisocalafate.com
nelps.com
buywatch.win
sgfmim.site
mexicotradicional.com
moving411.biz
mcavoy.tech
legcity.com
maoshudian.com
avintor.com
pushedtotheedge.com
computerdustcover.info
rkqpdgfj.com
baltimorepropertysolutions.com
uthome4sale.com
amvnkq.men
parkapiki.com
bcnnet.online
jerseyhighend.biz
fgas.ltd
kafeventos.com
fourmseeding.site
52yinong.com
wildgrapevine.info
learnfxlive.com
bm849.com
mbafftest.com
xionganshotel.com
day4pt.com
xmzwgc.com
nationalprofileplusmagazine.com
glizmb.men
makeuphealthtoolsvip.win
waitingwords.com
faku.ltd
premierbasketballacademy.com
askoshop.site
mindingmymindset.com
igopin.com
iamlab.tech
royalgroupind.com
filmy-popcorn.com
perfectclass.info
samanthagrace.studio
adservice.download
china1.ltd
novisma.info
droidi.net
zozome.com
titansbrasil.com
bolipy.com
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/4904-15-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/4904-19-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/4904-20-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe -
Executes dropped EXE 2 IoCs
pid Process 2788 app.exe 4904 app.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\app.exe -boot" app.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2788 set thread context of 4904 2788 app.exe 105 PID 4904 set thread context of 3436 4904 app.exe 56 PID 4904 set thread context of 1372 4904 app.exe 101 PID 4904 set thread context of 3436 4904 app.exe 56 PID 4336 set thread context of 3436 4336 msdt.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language app.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language app.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3028 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4904 app.exe 4904 app.exe 4904 app.exe 4904 app.exe 4904 app.exe 4904 app.exe 4336 msdt.exe 4336 msdt.exe 4336 msdt.exe 4336 msdt.exe 4336 msdt.exe 4336 msdt.exe 4336 msdt.exe 4336 msdt.exe 4336 msdt.exe 4336 msdt.exe 4336 msdt.exe 4336 msdt.exe 4336 msdt.exe 4336 msdt.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4904 app.exe 4904 app.exe 4904 app.exe 4904 app.exe 4904 app.exe 4336 msdt.exe 4336 msdt.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2128 JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe Token: SeDebugPrivilege 2788 app.exe Token: SeDebugPrivilege 4904 app.exe Token: SeDebugPrivilege 4336 msdt.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2128 wrote to memory of 4464 2128 JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe 95 PID 2128 wrote to memory of 4464 2128 JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe 95 PID 2128 wrote to memory of 4464 2128 JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe 95 PID 2128 wrote to memory of 932 2128 JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe 100 PID 2128 wrote to memory of 932 2128 JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe 100 PID 2128 wrote to memory of 932 2128 JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe 100 PID 1372 wrote to memory of 2788 1372 explorer.exe 102 PID 1372 wrote to memory of 2788 1372 explorer.exe 102 PID 1372 wrote to memory of 2788 1372 explorer.exe 102 PID 2788 wrote to memory of 4904 2788 app.exe 105 PID 2788 wrote to memory of 4904 2788 app.exe 105 PID 2788 wrote to memory of 4904 2788 app.exe 105 PID 2788 wrote to memory of 4904 2788 app.exe 105 PID 2788 wrote to memory of 4904 2788 app.exe 105 PID 2788 wrote to memory of 4904 2788 app.exe 105 PID 1372 wrote to memory of 3028 1372 explorer.exe 106 PID 1372 wrote to memory of 3028 1372 explorer.exe 106 PID 1372 wrote to memory of 3028 1372 explorer.exe 106 PID 3436 wrote to memory of 4336 3436 Explorer.EXE 107 PID 3436 wrote to memory of 4336 3436 Explorer.EXE 107 PID 3436 wrote to memory of 4336 3436 Explorer.EXE 107 PID 4336 wrote to memory of 2560 4336 msdt.exe 108 PID 4336 wrote to memory of 2560 4336 msdt.exe 108 PID 4336 wrote to memory of 2560 4336 msdt.exe 108
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54ef2f2acdf62dfb40fc32aab1f46307.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\app.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4464
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\app.exe"3⤵
- System Location Discovery: System Language Discovery
PID:932
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\app.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2560
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\app.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\app.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\app.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\app.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4904
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Gathers network information
PID:3028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
457KB
MD554ef2f2acdf62dfb40fc32aab1f46307
SHA13f3640685b7af5b52a13d49cfd1cf5364114e317
SHA256f384ded729fd7bf92383bf1ee12b4e3da92fbb01ef0e9d84bf439ba70525210d
SHA5123ee12f2d99ce1ce272f99b7e190694f52aaf68bb2267f53efb6073d79100a3d127ad841bd9324d675af527e06bb9c56218ff1e91dfb644af1d21042cf049ff03