Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2025, 02:17
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe
-
Size
1.2MB
-
MD5
699edf850842ec51a724978a5fc82b20
-
SHA1
61808b6843d964cd0bde9265c2d79fc90bd58c9d
-
SHA256
31cc5066dbae31b30a888b6ea8c70275b2e87eb7171b318fced6315ae1567a8c
-
SHA512
364993cf7bc41cb86c20be4c5a34156e30d0a448920a67e23a2727d7f56a9912347a6d3ce14b5dceb3978f81dfe169957d363642c5f3d141907e8cd796bb317a
-
SSDEEP
24576:5moJEeKzf6IqLdJzD/8OakJ6ZxP6BYWqr3VVc7uObrp8og+ex0UKRfh:rJEejIIXzr8CEZxSKpJW9v2oR3UKR
Malware Config
Signatures
-
Hawkeye family
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1808 set thread context of 4652 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 85 PID 4652 set thread context of 408 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 87 PID 4652 set thread context of 4240 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 94 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe Token: SeDebugPrivilege 408 vbc.exe Token: SeDebugPrivilege 4240 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1808 wrote to memory of 2132 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 83 PID 1808 wrote to memory of 2132 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 83 PID 1808 wrote to memory of 2132 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 83 PID 1808 wrote to memory of 4072 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 84 PID 1808 wrote to memory of 4072 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 84 PID 1808 wrote to memory of 4072 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 84 PID 1808 wrote to memory of 4652 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 85 PID 1808 wrote to memory of 4652 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 85 PID 1808 wrote to memory of 4652 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 85 PID 1808 wrote to memory of 4652 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 85 PID 1808 wrote to memory of 4652 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 85 PID 1808 wrote to memory of 4652 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 85 PID 1808 wrote to memory of 4652 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 85 PID 1808 wrote to memory of 4652 1808 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 85 PID 4652 wrote to memory of 408 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 87 PID 4652 wrote to memory of 408 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 87 PID 4652 wrote to memory of 408 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 87 PID 4652 wrote to memory of 408 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 87 PID 4652 wrote to memory of 408 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 87 PID 4652 wrote to memory of 408 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 87 PID 4652 wrote to memory of 408 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 87 PID 4652 wrote to memory of 408 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 87 PID 4652 wrote to memory of 408 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 87 PID 4652 wrote to memory of 4240 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 94 PID 4652 wrote to memory of 4240 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 94 PID 4652 wrote to memory of 4240 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 94 PID 4652 wrote to memory of 4240 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 94 PID 4652 wrote to memory of 4240 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 94 PID 4652 wrote to memory of 4240 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 94 PID 4652 wrote to memory of 4240 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 94 PID 4652 wrote to memory of 4240 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 94 PID 4652 wrote to memory of 4240 4652 JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe"2⤵PID:2132
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe"2⤵PID:4072
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
- Suspicious use of AdjustPrivilegeToken
PID:408
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4240
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\JaffaCakes118_699edf850842ec51a724978a5fc82b20.exe.log
Filesize312B
MD51754173b0ed4624c61fcf04f894e5bb6
SHA12fbf7999a2e14f19c9aeb1ac0e58b8a3859368b1
SHA25619e1f5731300f62cc4bb6eac90e96b7ff5de1bf8c13a434f1a7e38ee6927d757
SHA51263ae7b7da19c5b65ce73565042cf7386c8d53ab6645b901a9f684d5039e28addd91938d8d61cec153b675e80c25d92fae62bff53edf19914643c94f3a56db710
-
Filesize
327B
MD51265c5140a2f68b05b92aa1a25a2abb6
SHA1627a660e9d2a41c8c4a662ca44fdb68a1356bc82
SHA256694bae0c1ebf6f8eeb8d902b1bfad57ed9a42dea6d3e327a0137a1c9f4f0c6b9
SHA512ad6a1dd57ec84459f28926d07e25f2c4f49dc67ff95b8400e85c3bcb8eccc471dbac5e2b1a2758fb563866ecacc2fae4657dfb85197fb4cd2547eef334b8a216
-
Filesize
1KB
MD501e7975c708365983265ae40d604beb4
SHA1f1c793c9b7a312d355cd944928ba9272bbeec44e
SHA25695d7aeb5f67dc33d0b62d02b26a5d469436f58f2246fd95189a8b86220bc9a40
SHA5129c67c306fbb0e191ea7af01388c6a99714c353590d99887ddd0b0ceee3f6cd3af2e7b2c8d1d22a5a34dac746e4b2156876d935a658afc9a1d38597fd4922e023