Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2025, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe
-
Size
271KB
-
MD5
f9f96ce631b7e442af90334a7d362525
-
SHA1
cd687a557f710552222989713a93316a5657adf4
-
SHA256
c40d4bea682186b7adf6828f71685c7039719a343f2c48f1240fab3f442a2b4f
-
SHA512
66558a64a9d86f47b9c753e69e161184f449d840179b1becdb23b0fab4fe9cace7e0e3b48404740a8bb4530f8a82b96ab39855df02585dd4003e5cfa3baef60e
-
SSDEEP
6144:q+FNvDu5NMsd+mF9gNMrhsgRx2aHNs8DtD1SpUx+:lFxDAdMmF94KZJ+L
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2788 32dee2ac5bf3c47e.exe -
Executes dropped EXE 2 IoCs
pid Process 2788 32dee2ac5bf3c47e.exe 2160 32dee2ac5bf3c47e.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*System Health Monitoring Service Pro = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\32dee2ac5bf3c47e.exe\"" 32dee2ac5bf3c47e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Health Monitoring Service Pro = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\32dee2ac5bf3c47e.exe\"" 32dee2ac5bf3c47e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*System Health Monitoring Service Pro = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\32dee2ac5bf3c47e.exe\"" 32dee2ac5bf3c47e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Health Monitoring Service Pro = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\32dee2ac5bf3c47e.exe\"" 32dee2ac5bf3c47e.exe -
resource yara_rule behavioral2/memory/4032-1-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-6-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-7-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4032-9-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-11-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-12-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-18-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-19-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-20-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-21-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-22-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-23-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-24-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-25-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-26-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-27-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-28-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-29-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-30-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-31-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-32-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-33-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-34-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-35-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-36-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-37-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-38-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-39-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-42-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-43-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-44-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-45-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-46-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-47-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2788-48-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2160-49-0x0000000000400000-0x0000000000541000-memory.dmp upx -
Program crash 20 IoCs
pid pid_target Process procid_target 4992 4032 WerFault.exe 84 5060 4032 WerFault.exe 84 4248 2788 WerFault.exe 85 4068 2160 WerFault.exe 91 3844 2788 WerFault.exe 85 664 2788 WerFault.exe 85 1140 2788 WerFault.exe 85 4048 2788 WerFault.exe 85 856 2788 WerFault.exe 85 4008 2788 WerFault.exe 85 2648 2788 WerFault.exe 85 1708 2788 WerFault.exe 85 4216 2788 WerFault.exe 85 1480 2788 WerFault.exe 85 1908 2788 WerFault.exe 85 1596 2788 WerFault.exe 85 1708 2788 WerFault.exe 85 1868 2160 WerFault.exe 91 1832 2788 WerFault.exe 85 5044 2788 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32dee2ac5bf3c47e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32dee2ac5bf3c47e.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4032 wrote to memory of 2788 4032 JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe 85 PID 4032 wrote to memory of 2788 4032 JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe 85 PID 4032 wrote to memory of 2788 4032 JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe 85 PID 2788 wrote to memory of 2160 2788 32dee2ac5bf3c47e.exe 91 PID 2788 wrote to memory of 2160 2788 32dee2ac5bf3c47e.exe 91 PID 2788 wrote to memory of 2160 2788 32dee2ac5bf3c47e.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\32dee2ac5bf3c47e.exe:*C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f96ce631b7e442af90334a7d362525.exe *2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\32dee2ac5bf3c47e.exea ZZZZZZXSRRG3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2160 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 6164⤵
- Program crash
PID:4068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 6164⤵
- Program crash
PID:1868
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 6603⤵
- Program crash
PID:4248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 8603⤵
- Program crash
PID:3844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 9003⤵
- Program crash
PID:664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 9203⤵
- Program crash
PID:1140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 9123⤵
- Program crash
PID:4048
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 9923⤵
- Program crash
PID:856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 11003⤵
- Program crash
PID:4008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 12043⤵
- Program crash
PID:2648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 15283⤵
- Program crash
PID:1708
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 15883⤵
- Program crash
PID:4216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 16043⤵
- Program crash
PID:1480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 16483⤵
- Program crash
PID:1908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 16203⤵
- Program crash
PID:1596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 13003⤵
- Program crash
PID:1708
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 17763⤵
- Program crash
PID:1832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 18523⤵
- Program crash
PID:5044
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 1402⤵
- Program crash
PID:4992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 1522⤵
- Program crash
PID:5060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4032 -ip 40321⤵PID:2984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4032 -ip 40321⤵PID:4668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2788 -ip 27881⤵PID:2604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2160 -ip 21601⤵PID:3588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2788 -ip 27881⤵PID:2856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2788 -ip 27881⤵PID:4500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2788 -ip 27881⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2788 -ip 27881⤵PID:1576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2788 -ip 27881⤵PID:1780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2788 -ip 27881⤵PID:4072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2788 -ip 27881⤵PID:1920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2788 -ip 27881⤵PID:1312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2788 -ip 27881⤵PID:4492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2788 -ip 27881⤵PID:2464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2788 -ip 27881⤵PID:4496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2788 -ip 27881⤵PID:980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2788 -ip 27881⤵PID:2572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2160 -ip 21601⤵PID:3628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2788 -ip 27881⤵PID:3632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2788 -ip 27881⤵PID:1732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271KB
MD565f2bea4a88eb19f511054eeabfc518e
SHA13fa095424ff06d828793927481f26369a645040f
SHA256dd7f90575b484311c54ad7917707251eb24c65aa49016f59e5e213f750bbef46
SHA512d4f63d57806151420a8d3a7baf974d8cd05e8c5606bcc6f9d03519a2a92c8719d69eda641885b048871d1d1235ccb0589fde94557ece9ce5994634b2b529a283