Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 14:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa87fd28fc92dd89efc9bf0215aa6ebb_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
fa87fd28fc92dd89efc9bf0215aa6ebb_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
fa87fd28fc92dd89efc9bf0215aa6ebb_JaffaCakes118.exe
-
Size
252KB
-
MD5
fa87fd28fc92dd89efc9bf0215aa6ebb
-
SHA1
485ea45c96d00d36634c7eabf7a0f41871357d02
-
SHA256
50480142a432b6c1770e4a026ae416d784acfe8e449ed336aba1f6a2bbfcced5
-
SHA512
d73fe547cbbd9d6a8b58ceadb9bc269c277e9b36235ba1a5aa5c9c8e6e7e19da640638ede899699fdda79ec1cb7012f83d99581f67923b96e96f215c2307d208
-
SSDEEP
3072:gY7jaHLUCX34dmgJYsozBm2tfyXu1h5CeriHACqH/1ptrMAoSeLv5YXm:gAqUCXIdm/NBm2tuMpBeS
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" duufoul.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation fa87fd28fc92dd89efc9bf0215aa6ebb_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3284 duufoul.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /o" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /I" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /v" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /G" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /m" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /L" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /s" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /W" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /V" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /D" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /J" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /x" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /k" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /K" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /h" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /N" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /B" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /c" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /U" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /E" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /H" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /F" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /e" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /t" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /p" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /T" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /y" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /n" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /b" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /j" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /Q" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /q" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /l" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /i" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /P" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /u" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /X" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /d" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /Y" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /A" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /a" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /Z" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /O" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /r" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /S" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /z" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /R" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /f" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /M" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /g" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /C" duufoul.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duufoul = "C:\\Users\\Admin\\duufoul.exe /w" duufoul.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe 3284 duufoul.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2324 fa87fd28fc92dd89efc9bf0215aa6ebb_JaffaCakes118.exe 3284 duufoul.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2324 wrote to memory of 3284 2324 fa87fd28fc92dd89efc9bf0215aa6ebb_JaffaCakes118.exe 90 PID 2324 wrote to memory of 3284 2324 fa87fd28fc92dd89efc9bf0215aa6ebb_JaffaCakes118.exe 90 PID 2324 wrote to memory of 3284 2324 fa87fd28fc92dd89efc9bf0215aa6ebb_JaffaCakes118.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa87fd28fc92dd89efc9bf0215aa6ebb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa87fd28fc92dd89efc9bf0215aa6ebb_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\duufoul.exe"C:\Users\Admin\duufoul.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5fb575eefe805d4ab38369f7a2eddc37e
SHA14d1934f12920092e9291c9c2ca7215062eda776c
SHA2567bac4db0bf16b6a66a21584200a701256de7861a3fa4e5eaaf28cfb915452486
SHA512b055aa2308e8b0312f70a2ff7bc09dad08202e2ff26912510f60f487da36b8b4a53f9e28c7b17278ad09ab0a98d51650ccc041914ae176a51080f5831a4ab734