Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 08:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fc61e9f92e24e4d32e5b2b06dd62b31a_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
fc61e9f92e24e4d32e5b2b06dd62b31a_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
fc61e9f92e24e4d32e5b2b06dd62b31a_JaffaCakes118.exe
-
Size
160KB
-
MD5
fc61e9f92e24e4d32e5b2b06dd62b31a
-
SHA1
a285f95da052c23fd8bf3e5228b6db896fe96807
-
SHA256
730ba1ecdbc582e4c708bb40ba566e809968e46e752635010aa8a06bbf3fb039
-
SHA512
c401ed116167f01910e05e2cb0fe08e5775d743a29ee122f69ecf0ae72f9ac2343861a16ddd069d518cac380e60a87dd1aaf5ce0f334df6f7420d3a2f214158f
-
SSDEEP
768:SVXL+uSmHRCfKy09p42hoJ0h4h2hQJVNjDkp57xXp5Rmg5Fh4hqhxOhDhzhnhvhB:SZqPfKyQ/Jh4h2hON6x5puwVT0h
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation fc61e9f92e24e4d32e5b2b06dd62b31a_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3188 haoayo.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /T" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /Y" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /d" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /M" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /S" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /b" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /m" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /p" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /n" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /j" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /z" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /u" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /o" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /F" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /c" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /f" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /i" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /k" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /e" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /R" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /y" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /g" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /H" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /J" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /W" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /w" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /r" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /a" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /X" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /V" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /C" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /x" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /t" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /A" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /K" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /O" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /G" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /N" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /q" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /U" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /Q" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /L" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /h" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /Z" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /s" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /E" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /P" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /D" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /B" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /v" haoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\haoayo = "C:\\Users\\Admin\\haoayo.exe /l" haoayo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe 3188 haoayo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3012 fc61e9f92e24e4d32e5b2b06dd62b31a_JaffaCakes118.exe 3188 haoayo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 3188 3012 fc61e9f92e24e4d32e5b2b06dd62b31a_JaffaCakes118.exe 90 PID 3012 wrote to memory of 3188 3012 fc61e9f92e24e4d32e5b2b06dd62b31a_JaffaCakes118.exe 90 PID 3012 wrote to memory of 3188 3012 fc61e9f92e24e4d32e5b2b06dd62b31a_JaffaCakes118.exe 90 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89 PID 3188 wrote to memory of 3012 3188 haoayo.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc61e9f92e24e4d32e5b2b06dd62b31a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc61e9f92e24e4d32e5b2b06dd62b31a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\haoayo.exe"C:\Users\Admin\haoayo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵PID:2756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD58713d9593ceb5f9dd11acc4041299ccb
SHA148de9a2b4b7e44856d273896d35f5d3e6e687575
SHA256184cb36b85b4a53a2472b82870924e5ab31b175b2bc8a9283afa4ba1324b204a
SHA5123a5736c6c26a93b4e00d537b2c7d749c1259a44757b2ed0a9432320119301e8d79951cbbdc75dceee91d492194294571106c92a7a86418ed44cbabf5130cb36f