Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 19:01
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe
-
Size
132KB
-
MD5
d045f8b1c180eb6a5ed7649412870d3a
-
SHA1
676d5fac152feea00a7bc5680f6df20d0abbfcf6
-
SHA256
105e589ca9105d157ef06c860c0b11dc56b0f3e138c2123b804bfe400e70a1e9
-
SHA512
31512d5347555af2abd4426c9d82982172637e7849f82ec59ffaa49c604566f87c6c3d81f93cae8fea06efb4171c08aecec90ebc55e142b6b375e72c4f86bb6e
-
SSDEEP
3072:xacOO5PDVkRsmDdqlbxmk9BVi4itizWhWWFrxsl:xacOEDHRxmWbi4UizQWWz4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2760 trivax1.Bin.exe -
Loads dropped DLL 2 IoCs
pid Process 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\trivax1.Bin.exe = "C:\\trivax1.Bin\\trivax1.Bin.exe" trivax1.Bin.exe -
resource yara_rule behavioral1/memory/2156-2-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/2156-3-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/2156-5-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/2760-17-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/2760-26-0x0000000000400000-0x0000000000467000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trivax1.Bin.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PhishingFilter trivax1.Bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" trivax1.Bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0" trivax1.Bin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery trivax1.Bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0" trivax1.Bin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe 2760 trivax1.Bin.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe Token: SeDebugPrivilege 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe Token: SeDebugPrivilege 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe Token: SeDebugPrivilege 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe Token: SeDebugPrivilege 2760 trivax1.Bin.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2156 wrote to memory of 1228 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 21 PID 2156 wrote to memory of 380 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 3 PID 2156 wrote to memory of 428 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 5 PID 2156 wrote to memory of 488 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 7 PID 2156 wrote to memory of 496 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 8 PID 2156 wrote to memory of 612 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 9 PID 2156 wrote to memory of 688 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 10 PID 2156 wrote to memory of 760 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 11 PID 2156 wrote to memory of 820 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 12 PID 2156 wrote to memory of 864 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 13 PID 2156 wrote to memory of 972 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 15 PID 2156 wrote to memory of 268 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 16 PID 2156 wrote to memory of 844 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 17 PID 2156 wrote to memory of 1072 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 18 PID 2156 wrote to memory of 1092 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 19 PID 2156 wrote to memory of 1168 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 20 PID 2156 wrote to memory of 1228 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 21 PID 2156 wrote to memory of 1392 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 23 PID 2156 wrote to memory of 1560 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 24 PID 2156 wrote to memory of 1656 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 25 PID 2156 wrote to memory of 2908 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 26 PID 2156 wrote to memory of 2924 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 27 PID 2156 wrote to memory of 2760 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 30 PID 2156 wrote to memory of 2760 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 30 PID 2156 wrote to memory of 2760 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 30 PID 2156 wrote to memory of 2760 2156 JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe 30 PID 2760 wrote to memory of 1228 2760 trivax1.Bin.exe 21 PID 2760 wrote to memory of 380 2760 trivax1.Bin.exe 3 PID 2760 wrote to memory of 428 2760 trivax1.Bin.exe 5 PID 2760 wrote to memory of 488 2760 trivax1.Bin.exe 7 PID 2760 wrote to memory of 496 2760 trivax1.Bin.exe 8 PID 2760 wrote to memory of 612 2760 trivax1.Bin.exe 9 PID 2760 wrote to memory of 688 2760 trivax1.Bin.exe 10 PID 2760 wrote to memory of 760 2760 trivax1.Bin.exe 11 PID 2760 wrote to memory of 820 2760 trivax1.Bin.exe 12 PID 2760 wrote to memory of 864 2760 trivax1.Bin.exe 13 PID 2760 wrote to memory of 972 2760 trivax1.Bin.exe 15 PID 2760 wrote to memory of 268 2760 trivax1.Bin.exe 16 PID 2760 wrote to memory of 844 2760 trivax1.Bin.exe 17 PID 2760 wrote to memory of 1072 2760 trivax1.Bin.exe 18 PID 2760 wrote to memory of 1092 2760 trivax1.Bin.exe 19 PID 2760 wrote to memory of 1168 2760 trivax1.Bin.exe 20 PID 2760 wrote to memory of 1228 2760 trivax1.Bin.exe 21 PID 2760 wrote to memory of 1392 2760 trivax1.Bin.exe 23 PID 2760 wrote to memory of 1560 2760 trivax1.Bin.exe 24 PID 2760 wrote to memory of 1656 2760 trivax1.Bin.exe 25 PID 2760 wrote to memory of 2908 2760 trivax1.Bin.exe 26 PID 2760 wrote to memory of 2924 2760 trivax1.Bin.exe 27 PID 2760 wrote to memory of 2156 2760 trivax1.Bin.exe 29 PID 2760 wrote to memory of 2060 2760 trivax1.Bin.exe 31 PID 2760 wrote to memory of 1488 2760 trivax1.Bin.exe 32 PID 2760 wrote to memory of 1612 2760 trivax1.Bin.exe 33
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵PID:612
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe2⤵PID:1560
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:1656
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}2⤵PID:2060
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}2⤵PID:1488
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding2⤵PID:1612
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS1⤵PID:688
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:760
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted1⤵PID:820
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"2⤵PID:1168
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵PID:972
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService1⤵PID:268
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:844
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵PID:1072
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1092
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d045f8b1c180eb6a5ed7649412870d3a.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\trivax1.Bin\trivax1.Bin.exe"C:\trivax1.Bin\trivax1.Bin.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵PID:1392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation1⤵PID:2908
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵PID:2924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD596f4ed1e6523ea5fd57e457fe8e12977
SHA19c48d689c0d46dd4b30f3441715a384014993be2
SHA2563e017d7f2bcc0fa41a28f1403d006ab19e46c209b276151c0e53ebda7fe50f64
SHA51251f9c662f29090a940a6d231e8bf607f43368f73e415edc3138b2ae5f47ab7fb8c96f460e0c822549923c33077c2794aa01586941cecf0f2be739f096a351a08
-
Filesize
132KB
MD5d045f8b1c180eb6a5ed7649412870d3a
SHA1676d5fac152feea00a7bc5680f6df20d0abbfcf6
SHA256105e589ca9105d157ef06c860c0b11dc56b0f3e138c2123b804bfe400e70a1e9
SHA51231512d5347555af2abd4426c9d82982172637e7849f82ec59ffaa49c604566f87c6c3d81f93cae8fea06efb4171c08aecec90ebc55e142b6b375e72c4f86bb6e