Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2025, 02:44
Behavioral task
behavioral1
Sample
JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
General
-
Target
JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe
-
Size
208KB
-
MD5
62c21c26fc4b8585e759fe342c5d88ef
-
SHA1
f331edd3dc4716b31af9cfed4dbac1907d85bae3
-
SHA256
3545e8a1473a00e75a58d82d4efa370334d2a921d77b1aa2a52c49198cc8c0b2
-
SHA512
0f0201307bdbe036e6a135a1cd0f4b54e024df9e591c0feec30dfadab3217e96e7d5538bde43e82057a767cf59a64b75a4a39f314bef0444b038c33e6aa533e9
-
SSDEEP
3072:M3MWkcMqoEt1zk9z4Uh+yQAbAbuXNWtMpebimeN7kgMwAd/cYAmyP5qovQ:M3sc6TDTQAbHMbxg7kVwAy1P5qo
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4640 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 812 JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe 4640 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Ceoi\Pgimikcmo.jpg JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe File created C:\Program Files (x86)\Ceoi\Pgimikcmo.jpg JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe 4640 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 812 JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe Token: SeRestorePrivilege 812 JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe Token: SeBackupPrivilege 812 JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe Token: SeRestorePrivilege 812 JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe Token: SeBackupPrivilege 812 JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe Token: SeRestorePrivilege 812 JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe Token: SeBackupPrivilege 812 JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe Token: SeRestorePrivilege 812 JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62c21c26fc4b8585e759fe342c5d88ef.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:812
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99B
MD54a2619cea2f63203a132a3a43de7f4f3
SHA1c2f18aa51109150c234e5c3ccef0f3cc12e99e48
SHA2567405091a5d1de21c8dc4f223dc8d871f3a09ac8123dfc8ca59fef51afdb964b1
SHA5125fe88ad3631d5a321b8f5e398509f31a4d2564ce3e007a7ba60754b3136dbd22b50026d7e356154c6e8b8c40708d13beff894b957c89eaf8bd61aeae0a817c3a
