Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 04:10
Behavioral task
behavioral1
Sample
f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
f978fad57f5f65c32202a5034482f833
-
SHA1
ae03de9c03bd1679c0565eb93293fad68a0765a5
-
SHA256
9396920787de72a4a6fc5a87c0decafeb5aec45766a1b0b20a15f50dfcf5675e
-
SHA512
55a49b3157a500ff6c10477a3efdc3942ef129c2fdce165b096277218584deb21d25fd604ed4cb2dd998d04b19f118660e98c3eead123e4674d6e08f576a8c9e
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqA:SCqm2Jpr0nNM7Dus7Nxt
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2768-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000229e4-5.dat upx behavioral2/memory/2768-299-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\kab.txt f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\7-Zip\Lang\el.txt.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\resources.pak f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\7-Zip\Lang\it.txt.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\7-Zip\Lang\fr.txt.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\7-Zip\Lang\da.txt.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\7-Zip\Lang\pl.txt.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ExtExport.exe.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\unpack.dll.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\EnterSelect.jpg.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.exe f978fad57f5f65c32202a5034482f833_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD598010d20c25b6f1570a6c905a5bb1526
SHA13f16ca3c5f2e22baa8e50eef5d15ded47685bacd
SHA256da441d90c70f6798ae8ebd5bfd30e567befc89b281bbd2a7c851ea8dfc81b7e6
SHA51293dbe08149707540edaa6af161537fd7ce5e6a3a53d2797fca5d7f0476a96297f4cf4e58efba697000a8ae74b1356a99fc6b9785bf9a3dba6ec3e2712c2366b2