Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
01/03/2025, 07:33
Behavioral task
behavioral1
Sample
JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
General
-
Target
JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe
-
Size
196KB
-
MD5
3799b16d1a28b031cf761ac3b2539d7b
-
SHA1
d568cac4c45dd3c0cc46051edb9949a48cf7a26f
-
SHA256
018a11878b175039255fafc575acffc59dc0620ade4f4c6ca38ec11b01317cf4
-
SHA512
5b4089bfd2ac5d5acba1a2cf666a40b8d1ee6d7947132fe48b9be32e82e62c510ec222f01a4c426c2708d30631810850bf5b88c2b6fc2a4dd99e8d55849ba59a
-
SSDEEP
3072:+eMWMcMgoEt3zk9z4Uh+yQAbAbu7NWtMpebimeN7kgMwzi/HPeqov:+ekcw5DTQAbbMbxg7kVwzSeqo
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3248 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 3220 JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe 3248 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe File created C:\Windows\FileName.jpg JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe 3248 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 3220 JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe Token: SeRestorePrivilege 3220 JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe Token: SeBackupPrivilege 3220 JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe Token: SeRestorePrivilege 3220 JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe Token: SeBackupPrivilege 3220 JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe Token: SeRestorePrivilege 3220 JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe Token: SeBackupPrivilege 3220 JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe Token: SeRestorePrivilege 3220 JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3799b16d1a28b031cf761ac3b2539d7b.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99B
MD5a240e261d61ddb9e57122b8ca7c3b84f
SHA1d54cfdf0b9db760ed1ad84409088128074d867d7
SHA2569d68bae5a66e775f2a43dd552b5b1011ff4869f79cf3c9b97e37f1e79df664a5
SHA51229fba4204bf3974a9539d22560ce0b289dc05b7ead0e28bb40d81f69ff2de1d02e4a849294b3dbdc9e8c3da80031b746173cec9b46ec867adcf292a5ba77f832
