Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
66s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 04:05
Static task
static1
Behavioral task
behavioral1
Sample
04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe
-
Size
954KB
-
MD5
04564837a1a7ffae1d43b74d63c6691b
-
SHA1
593cb5a27546fb633e0455469ee2c2be4c7994fa
-
SHA256
4833e34516bd6ae34b216eb29f2cf6cf1b6f27123f212f1c696ddecec56f75d6
-
SHA512
795273eb80129e9d54ba38665928d6c9049a9a349da0de74f79720af8a525f32ef2b236ec44b004e0517385323bbc36b437e036ad9a5961f7c35eccb2d80c9f6
-
SSDEEP
24576:depzFWcoV7h4g2HCO5BeJ5tXdRGvtf2F6xHjb1ua/5:MWc+18wrXdwvtYnY5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128}\1.0 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128}\1.0\ = "InstallerLib" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\LocalServer32 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E} 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128}\1.0\0 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\TypeLib\Version = "1.0" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\TypeLib 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\TypeLib\ = "{3C833939-0116-49DB-9275-19B65240F128}" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\whereat.karaokes.1 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128}\1.0 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128}\1.0\FLAGS\ = "0" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\ProxyStubClsid32 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\ProgID 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128}\1.0\FLAGS 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\TypeLib 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\whereat.karaokes.1\CLSID\ = "{83d3b36f-9fa6-44da-98a8-ed5f39782dae}" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\Programmable 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\Version 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\ = "IBoot" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\VersionIndependentProgID 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\TypeLib 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\whereat.karaokes.1\CLSID 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\TypeLib 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\ProxyStubClsid32 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\ProxyStubClsid32 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\whereat.karaokes\CurVer 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\ProgID\ = "whereat.karaokes.1" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\whereat.karaokes 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E} 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\ProgID 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\TypeLib 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\whereat.karaokes.1\CLSID 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\whereat.karaokes\ = "Inst Class" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128} 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128}\1.0\HELPDIR 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\TypeLib\ = "{3C833939-0116-49DB-9275-19B65240F128}" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\whereat.karaokes\CurVer 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\whereat.karaokes.1 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\ = "Inst Class" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\VersionIndependentProgID\ = "whereat.karaokes" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\TypeLib 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\TypeLib\ = "{3c833939-0116-49db-9275-19b65240f128}" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E} 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128}\1.0\0 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\ = "IBoot" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae} 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\whereat.karaokes 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\Version\ = "1.0" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128}\1.0\0\win32 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\LocalServer32 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E} 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\whereat.karaokes\CurVer\ = "whereat.karaokes.1" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae} 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\Version 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128}\1.0\0\win32 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128}\1.0\HELPDIR 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\VersionIndependentProgID 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83d3b36f-9fa6-44da-98a8-ed5f39782dae}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe\"" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\ProxyStubClsid32 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EB803F6-E90E-475C-81E7-5A59D43DF66E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C833939-0116-49DB-9275-19B65240F128} 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe:typelib 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 884 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe 884 04564837a1a7ffae1d43b74d63c6691b_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD55e2a95d9e29df09b27f9a01f71328285
SHA1c156e45d67164c0e3c94c94080d87c3ad2415cf6
SHA256995779fd2a266e2ba745cc8973d3c9556025b5420bcc8c3287e9a8938ad1a713
SHA5128c4e716bc25e81119d4f08d44e15c94f4079f4c9a062f2ddbc2f6d2da578fe1d6b9e11dae7d0934b63fae0da406050b45944242f4069651ec422cef6aa3f1b26