Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2025, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe
-
Size
7.9MB
-
MD5
f9f3468705375294fe0e98dae9f37225
-
SHA1
4b9dabacf25c95f1c0879bf3c93275e42d3e2aad
-
SHA256
8f40d4671e157a13e50d7194870918d95945cc338f867d22a0c23d879b568b7d
-
SHA512
580d5e1ad881865b804cfee4bb7fc1ba37e56b6328eb64c18ac1f44f733a6054703415455e15f9de16948e76a764b77ec21cc882bec04611745865fccef48762
-
SSDEEP
196608:87azg7DSm7azg7DSm7azg7DSm7azg7DSN:Xg7utg7utg7utg7uN
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe -
Executes dropped EXE 3 IoCs
pid Process 2472 7D57AD13E21.exe 4968 Scegli_nome_allegato.exe 4360 7D57AD13E21.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\7D57AD13E21.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2472 set thread context of 4360 2472 7D57AD13E21.exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D57AD13E21.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Scegli_nome_allegato.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D57AD13E21.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\IESettingSync Scegli_nome_allegato.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" Scegli_nome_allegato.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Scegli_nome_allegato.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Scegli_nome_allegato.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1972 reg.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4968 Scegli_nome_allegato.exe 4968 Scegli_nome_allegato.exe 4968 Scegli_nome_allegato.exe 4360 7D57AD13E21.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 316 wrote to memory of 1972 316 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 95 PID 316 wrote to memory of 1972 316 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 95 PID 316 wrote to memory of 1972 316 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 95 PID 316 wrote to memory of 2472 316 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 97 PID 316 wrote to memory of 2472 316 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 97 PID 316 wrote to memory of 2472 316 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 97 PID 316 wrote to memory of 4968 316 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 98 PID 316 wrote to memory of 4968 316 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 98 PID 316 wrote to memory of 4968 316 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 98 PID 2472 wrote to memory of 4360 2472 7D57AD13E21.exe 102 PID 2472 wrote to memory of 4360 2472 7D57AD13E21.exe 102 PID 2472 wrote to memory of 4360 2472 7D57AD13E21.exe 102 PID 2472 wrote to memory of 4360 2472 7D57AD13E21.exe 102 PID 2472 wrote to memory of 4360 2472 7D57AD13E21.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe" /f2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1972
-
-
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4360
-
-
-
C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.9MB
MD530b6625d97c302d272dfdc61854bde66
SHA15b025c8fb9154af21fad6d922dca8de7e09876dd
SHA25618f8d40aa2217665a260558e7286a92d9b81434dc7b1ceb46aaaf3f2a168f5f6
SHA512a0cf72eb1428c7efd497513d3140014a7d0cb57179efff5c5eef5e158f358a213bd449fced27717bb6737ebd9ee56ca6684286b1daa7f08ebf82a59ad22f349c
-
Filesize
1.0MB
MD5a2f259ceb892d3b0d1d121997c8927e3
SHA16e0a7239822b8d365d690a314f231286355f6cc6
SHA256ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
SHA5125ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad