Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/04/2024, 17:30
Static task
static1
Behavioral task
behavioral1
Sample
e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe
-
Size
4.3MB
-
MD5
e579348f0efa5c965fa570e7da12d056
-
SHA1
70faa1e256d616121141c073b3ec6443f9de469d
-
SHA256
5d4447c12af07349b13f38c6d0dd226915a27a7bba6aa40b7b65ea6a87e3a305
-
SHA512
100e266a4a297ecee254f0398ca9c717ac972b236e3165b1a9736c6da31cb39b2127979610f070766539b14f1701fa4fcc41248f95d71f5f8a4a995d18b84644
-
SSDEEP
98304:mOcd1iEPw3V56K3U9+JYhfF5kt03XzzO6bcSiUyo2GE:mO+QE2V5++JYASDzO6biz5GE
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a0000000230f3-72.dat acprotect behavioral2/files/0x0007000000023341-71.dat acprotect -
resource yara_rule behavioral2/files/0x0007000000023340-39.dat aspack_v212_v242 behavioral2/files/0x000700000002333f-73.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation aimware.sfx.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation aimware.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 9 IoCs
pid Process 2640 aimware.sfx.exe 4380 aimware.exe 720 rutserv.exe 916 rutserv.exe 4104 rutserv.exe 3924 rutserv.exe 3560 rfusclient.exe 3364 rfusclient.exe 3996 rfusclient.exe -
resource yara_rule behavioral2/files/0x000a0000000230f3-72.dat upx behavioral2/files/0x0007000000023341-71.dat upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 4628 timeout.exe -
Kills process with taskkill 2 IoCs
pid Process 4760 taskkill.exe 2980 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings aimware.exe -
Runs .reg file with regedit 1 IoCs
pid Process 3468 regedit.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 720 rutserv.exe 720 rutserv.exe 720 rutserv.exe 720 rutserv.exe 720 rutserv.exe 720 rutserv.exe 916 rutserv.exe 916 rutserv.exe 4104 rutserv.exe 4104 rutserv.exe 3924 rutserv.exe 3924 rutserv.exe 3924 rutserv.exe 3924 rutserv.exe 3924 rutserv.exe 3924 rutserv.exe 3560 rfusclient.exe 3560 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 3996 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4760 taskkill.exe Token: SeDebugPrivilege 2980 taskkill.exe Token: SeDebugPrivilege 720 rutserv.exe Token: SeDebugPrivilege 4104 rutserv.exe Token: SeTakeOwnershipPrivilege 3924 rutserv.exe Token: SeTcbPrivilege 3924 rutserv.exe Token: SeTcbPrivilege 3924 rutserv.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 720 rutserv.exe 916 rutserv.exe 4104 rutserv.exe 3924 rutserv.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 3528 wrote to memory of 984 3528 e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe 94 PID 3528 wrote to memory of 984 3528 e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe 94 PID 3528 wrote to memory of 984 3528 e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe 94 PID 984 wrote to memory of 2640 984 cmd.exe 98 PID 984 wrote to memory of 2640 984 cmd.exe 98 PID 984 wrote to memory of 2640 984 cmd.exe 98 PID 2640 wrote to memory of 4380 2640 aimware.sfx.exe 99 PID 2640 wrote to memory of 4380 2640 aimware.sfx.exe 99 PID 2640 wrote to memory of 4380 2640 aimware.sfx.exe 99 PID 4380 wrote to memory of 2516 4380 aimware.exe 100 PID 4380 wrote to memory of 2516 4380 aimware.exe 100 PID 4380 wrote to memory of 2516 4380 aimware.exe 100 PID 2516 wrote to memory of 3596 2516 WScript.exe 101 PID 2516 wrote to memory of 3596 2516 WScript.exe 101 PID 2516 wrote to memory of 3596 2516 WScript.exe 101 PID 3596 wrote to memory of 4760 3596 cmd.exe 103 PID 3596 wrote to memory of 4760 3596 cmd.exe 103 PID 3596 wrote to memory of 4760 3596 cmd.exe 103 PID 3596 wrote to memory of 2980 3596 cmd.exe 107 PID 3596 wrote to memory of 2980 3596 cmd.exe 107 PID 3596 wrote to memory of 2980 3596 cmd.exe 107 PID 3596 wrote to memory of 4692 3596 cmd.exe 108 PID 3596 wrote to memory of 4692 3596 cmd.exe 108 PID 3596 wrote to memory of 4692 3596 cmd.exe 108 PID 3596 wrote to memory of 3468 3596 cmd.exe 109 PID 3596 wrote to memory of 3468 3596 cmd.exe 109 PID 3596 wrote to memory of 3468 3596 cmd.exe 109 PID 3596 wrote to memory of 4628 3596 cmd.exe 111 PID 3596 wrote to memory of 4628 3596 cmd.exe 111 PID 3596 wrote to memory of 4628 3596 cmd.exe 111 PID 3596 wrote to memory of 720 3596 cmd.exe 112 PID 3596 wrote to memory of 720 3596 cmd.exe 112 PID 3596 wrote to memory of 720 3596 cmd.exe 112 PID 3596 wrote to memory of 916 3596 cmd.exe 114 PID 3596 wrote to memory of 916 3596 cmd.exe 114 PID 3596 wrote to memory of 916 3596 cmd.exe 114 PID 3596 wrote to memory of 4104 3596 cmd.exe 116 PID 3596 wrote to memory of 4104 3596 cmd.exe 116 PID 3596 wrote to memory of 4104 3596 cmd.exe 116 PID 3924 wrote to memory of 3364 3924 rutserv.exe 121 PID 3924 wrote to memory of 3364 3924 rutserv.exe 121 PID 3924 wrote to memory of 3364 3924 rutserv.exe 121 PID 3924 wrote to memory of 3560 3924 rutserv.exe 120 PID 3924 wrote to memory of 3560 3924 rutserv.exe 120 PID 3924 wrote to memory of 3560 3924 rutserv.exe 120 PID 3560 wrote to memory of 3996 3560 rfusclient.exe 123 PID 3560 wrote to memory of 3996 3560 rfusclient.exe 123 PID 3560 wrote to memory of 3996 3560 rfusclient.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\programdata\1.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\programdata\aimware.sfx.exeaimware.sfx.exe -p123 -dc:\programdata3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\programdata\aimware.exe"C:\programdata\aimware.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\programdata\windows\install.vbs"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\windows\install.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rutserv.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfusclient.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f7⤵PID:4692
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "regedit.reg"7⤵
- Runs .reg file with regedit
PID:3468
-
-
C:\Windows\SysWOW64\timeout.exetimeout 27⤵
- Delays execution with timeout.exe
PID:4628
-
-
\??\c:\programdata\windows\rutserv.exerutserv.exe /silentinstall7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:720
-
-
\??\c:\programdata\windows\rutserv.exerutserv.exe /firewall7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:916
-
-
\??\c:\programdata\windows\rutserv.exerutserv.exe /start7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4104
-
-
-
-
-
-
-
\??\c:\programdata\windows\rutserv.exec:\programdata\windows\rutserv.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\programdata\windows\rfusclient.exec:\programdata\windows\rfusclient.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\programdata\windows\rfusclient.exec:\programdata\windows\rfusclient.exe /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:3996
-
-
-
\??\c:\programdata\windows\rfusclient.exec:\programdata\windows\rfusclient.exe /tray2⤵
- Executes dropped EXE
PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2276,i,1205556100727695622,5044463180471657307,262144 --variations-seed-version /prefetch:81⤵PID:3100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
MD58f5f1e00b524b066e052836fd9504aaa
SHA14dafcee2a6743385ec72240146eeeb884a2d47fe
SHA25679e13b0d4703411069ba6794fdc60eba0edad50e2fe0a1afe25e029a87617a28
SHA5126aa3bd4ab3d05652980da22ce2c88c9452f379dd78173c3827806256e0474f14654b20b72d4b910390a40d84ee9afa676c6ffc98fb23945f7f91475948f67373
-
Filesize
4.2MB
MD537726e188c9973ba3a0a4de57f96acc2
SHA10668e13cb10947603afccb75b8389d0571199c05
SHA25644f4edd71d129500693ed4f14d1977527b23cb5b3139b0f4e26ae8dd7c9ff19c
SHA512e24935dc1ab74decc2b18ebba8e4b4cfb0564b2735c9a275c5a679eeb8dbaee9cbfbaa551d734cffd252a61088f25ad217ffa00b7e0cebcbd53605af4d5e22ec
-
Filesize
480B
MD599db27d776e103cad354b531ee1f20b9
SHA10b82d146df8528f66d1d14756f211fd3a8b1b91a
SHA256240020a1a1941d1455135b5cb134e502a13b148be16cbb1552482aa03c29f8f3
SHA512bc2ed33495c0a752397b2f1b9b7ba65f94ea5be82dde74c618342c83b68f1b92a4783b672cd427843533799e1af0875e0fd000b12236852e9e2fa93005d7ac69
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
38B
MD510b10fec28fbccb28922b7ad20536150
SHA174a2327ebba2f695da13095a70f5161450b915aa
SHA25607420e294de66019f7fbaa4f87da9ee9dc7389cda09af38f7040f3cacda21dfb
SHA512d215c21000a213aa41a1599e269f704e31d96f7c4713962cac6a8bb8ef21f92b70aa257cd98d63496ffb220008b22d36d9ee52a66fa939f7fe59697b8a9c3729
-
Filesize
117B
MD565fc32766a238ff3e95984e325357dbb
SHA13ac16a2648410be8aa75f3e2817fbf69bb0e8922
SHA256a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420
SHA512621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608
-
Filesize
11KB
MD509ab259233e0f0880f2e2446f93cd88a
SHA103b9c6469c90023569f1884494504e2d3d6bbbc6
SHA2567f6e5d028aed528ad7af7672b53526a88a10846c5cf1e49bac3aeff5849a20cb
SHA512babc9e8d611476452026f60d61ee2a5bc2fc3d6303cfee60e894e7f0a4a8e2bd6195d52674cffb96b38c546296ed2c19eebd7aea98ffd5292f328d0f3e9da090
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
155KB
MD588318158527985702f61d169434a4940
SHA13cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA2564c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA5125d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff
-
Filesize
593KB
MD56298c0af3d1d563834a218a9cc9f54bd
SHA10185cd591e454ed072e5a5077b25c612f6849dc9
SHA25681af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe