Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe
-
Size
3.4MB
-
MD5
0b3a53ec25edfaacd5714245f96aa961
-
SHA1
333634d7925abf54d204fd30db806643a22b3051
-
SHA256
527317bebc4b27aa2bfdc72c548312bda57800b0062aa1ace6ad7fc3869afb18
-
SHA512
a3962ddabb1799509a9d82c218d6109448c16f7499cf12a7cf05749db0e1926e4eb60c26d13bffeb8444bda744fa00a4a2e8e520789874ae6b96505277cd8810
-
SSDEEP
98304:6Fu2QprAfsDm5Z0WCqXlU+C8AprN40Mr7ugHE:SIrAsWDXlY8o606lHE
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX54AA.tmp 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\dotnet.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iexplore.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5509.tmp 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5469.tmp 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5489.tmp 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\mip.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\LICLUA.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\LICLUA.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OSE.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\sIRC4.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\msinfo32.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe 0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD58995c7bbdb321889cfcb8351d0f067c1
SHA1af5f924cf254ca6f319b29f01ccd082a1a73d646
SHA2561fce698dcdcb69a650be5848345a3a6e9ab7322823f0f8fe3690eccda6e11819
SHA5121738be168c3876163f3e60c088e16dfa360a9a443bd0776c099198fc97f5f2f68bdc1e41710068dd18f4fe6f343e293802dfd0d876cd6a847d896be47c6fb3eb
-
Filesize
3.4MB
MD5374f6d3450063f3973ef83a93ec07e85
SHA1ca8ed48c4762dfcc714cebdf92cd2608f34e1968
SHA256cdd47d941e4775d326f5b6449f0d3e55d08235f6528c2f569515e99418d90958
SHA512e7afb7429d68e88fd39ba66d771dc06e16039beffa7e0eb90863789c9c272f62250676cd7b99798af62cdc1e54142ec7bb166152d8320eb26db3fc4eb1a5a6ce