Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3009a813a01...18.exe
windows7-x64
7009a813a01...18.exe
windows10-2004-x64
7$PLUGINSDI...nt.dll
windows7-x64
1$PLUGINSDI...nt.dll
windows10-2004-x64
1$PLUGINSDI...ed.htm
windows7-x64
1$PLUGINSDI...ed.htm
windows10-2004-x64
1$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ss.htm
windows7-x64
1$PLUGINSDI...ss.htm
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ss.htm
windows7-x64
1$PLUGINSDI...ss.htm
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...en.htm
windows7-x64
1$PLUGINSDI...en.htm
windows10-2004-x64
1$PLUGINSDI...t.html
windows7-x64
1$PLUGINSDI...t.html
windows10-2004-x64
1$PLUGINSDI...r.html
windows7-x64
1$PLUGINSDI...r.html
windows10-2004-x64
1$PLUGINSDI...ed.exe
windows7-x64
1$PLUGINSDI...ed.exe
windows10-2004-x64
1$PLUGINSDI...lay.js
windows7-x64
1$PLUGINSDI...lay.js
windows10-2004-x64
1$PLUGINSDI...min.js
windows7-x64
1$PLUGINSDI...min.js
windows10-2004-x64
1$PLUGINSDI...ger.js
windows7-x64
1$PLUGINSDI...ger.js
windows10-2004-x64
1$PLUGINSDI...ker.js
windows7-x64
1$PLUGINSDI...ker.js
windows10-2004-x64
1Analysis
-
max time kernel
55s -
max time network
59s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 10:53
Static task
static1
Behavioral task
behavioral1
Sample
009a813a01711978101f8fe50092cc93_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
009a813a01711978101f8fe50092cc93_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FDMClient.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FDMClient.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Failed.htm
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Failed.htm
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/FirefoxHandler.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/FirefoxHandler.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/NoneSilentSuccess.htm
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/NoneSilentSuccess.htm
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/Success.htm
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/Success.htm
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/WelcomeScreen.htm
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/WelcomeScreen.htm
Resource
win10v2004-20240419-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/manager/init.html
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/manager/init.html
Resource
win10v2004-20240419-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/manager/manager.html
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/manager/manager.html
Resource
win10v2004-20240419-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/manager/scripts/WebBrowser_embedded.exe
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/manager/scripts/WebBrowser_embedded.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/manager/scripts/gplay.js
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/manager/scripts/gplay.js
Resource
win10v2004-20240419-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/manager/scripts/jquery-1.10.1.min.js
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/manager/scripts/jquery-1.10.1.min.js
Resource
win10v2004-20240419-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/manager/scripts/manager.js
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/manager/scripts/manager.js
Resource
win10v2004-20240419-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/manager/scripts/sharedWorker.js
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/manager/scripts/sharedWorker.js
Resource
win10v2004-20240419-en
General
-
Target
009a813a01711978101f8fe50092cc93_JaffaCakes118.exe
-
Size
733KB
-
MD5
009a813a01711978101f8fe50092cc93
-
SHA1
f6643540b7f67a72b0884af8e504260637bdff46
-
SHA256
090f40c308def8848a645375eeb8758ca9b6796a0b07ad04f38f9f0e7571ad48
-
SHA512
d9cfdb309a7624865b26c417f1659dbdc3d63a4d390d363790f76b7b04a0ce3ad7b117ff2874d445ad77ecea4f3b744d97de62fc104d039ab175e346b1396644
-
SSDEEP
12288:3EEULYB8trQsWrhPfrj2WqBWQdIpnkiMMn3gNuzEDXKmCQlikzC+GavT17/1a:3HUkB8B2rhPzy/dIpkiMzIS6TQlL+paC
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4556 908 WerFault.exe 81 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\009a813a01711978101f8fe50092cc93_JaffaCakes118.exe = "11000" 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\WebBrowser_embedded.exe = "11000" 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Internet Explorer\IESettingSync 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe 908 009a813a01711978101f8fe50092cc93_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\009a813a01711978101f8fe50092cc93_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\009a813a01711978101f8fe50092cc93_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 40242⤵
- Program crash
PID:4556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 908 -ip 9081⤵PID:4328
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
222KB
MD5b8d9503e3c0ac31fae05382a2cc6197b
SHA1f6085be74247af30c2aa79a63e8bd1f9667951df
SHA256e57ec829e42342a1a0826c45a52e76b5cf038d3074f88b64b41dd75a367979c0
SHA5128b926afbd47b42541e51e3eed65eaa7dffab3295d0ee1350174b187995e0d232e2c5b76e426407577c590d6a2418ef12e37bddc15438c1eeaed1e134feda8f6d
-
Filesize
17KB
MD562008374a494afeea2ee2ae9eee4c8c0
SHA194808fcf0748c437f4d7ffa4d540e054cb014fab
SHA2569c4affddfa97b268b07c00ac28a2fe617dda806bf55088ccf348da149ee76c1a
SHA512f584ed647b69ff8ff80450be8f0b267ebb3c97826dbf01d078165ea94b43afd1f00fc58b91d9e8f4d78465d70312c1b1a6ac66583ebdc009b0ce471a6cf149a0
-
Filesize
1.4MB
MD5502644b41549622acc7c5116620a22e6
SHA1a7ce72ea70457478f244a3b9e04c5c61e72d6bee
SHA2564653dcd1cd888e0ee00f9f5312523354384f7aa2b3cdd1fd4ebb7a1300faaf51
SHA512cb236405d280e67262202d0f18acb5eee93ad5f0dbcb7207a267f6f8d8efd7042bb73b0f2ce8385c8f066976cc604830184ab645f09f9b930e31ad95c0e977f0