Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 03:35
Static task
static1
Behavioral task
behavioral1
Sample
15ccba874c14df1783540edc55843666_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
15ccba874c14df1783540edc55843666_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ibbbywk.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ibbbywk.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
General
-
Target
15ccba874c14df1783540edc55843666_JaffaCakes118.exe
-
Size
581KB
-
MD5
15ccba874c14df1783540edc55843666
-
SHA1
9d726cbc6f526bf6b6a0c13b30021fbc1c1c124a
-
SHA256
d32a6b84b3ddd7414f68356c7bac609a442afe9e507dc60d7d5a60bc8dd1a1a1
-
SHA512
02fd8f86dba589413071612ff9a17aec1553aed83363b716b7e8857f90c51d4925dba472d8f6379a259aedc7f93425cce5f033ce86f3534a3b8c74062c110419
-
SSDEEP
12288:cHrLOfbfw892zPjQ6BVfCrvjHaQqMETxfPGa7znERAXl8ifyNL/:cHGTliDwrvba8Elh7rxlHKr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2552 1431799351.exe -
Loads dropped DLL 11 IoCs
pid Process 2112 15ccba874c14df1783540edc55843666_JaffaCakes118.exe 2112 15ccba874c14df1783540edc55843666_JaffaCakes118.exe 2112 15ccba874c14df1783540edc55843666_JaffaCakes118.exe 2112 15ccba874c14df1783540edc55843666_JaffaCakes118.exe 1036 WerFault.exe 1036 WerFault.exe 1036 WerFault.exe 1036 WerFault.exe 1036 WerFault.exe 1036 WerFault.exe 1036 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1036 2552 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2668 wmic.exe Token: SeSecurityPrivilege 2668 wmic.exe Token: SeTakeOwnershipPrivilege 2668 wmic.exe Token: SeLoadDriverPrivilege 2668 wmic.exe Token: SeSystemProfilePrivilege 2668 wmic.exe Token: SeSystemtimePrivilege 2668 wmic.exe Token: SeProfSingleProcessPrivilege 2668 wmic.exe Token: SeIncBasePriorityPrivilege 2668 wmic.exe Token: SeCreatePagefilePrivilege 2668 wmic.exe Token: SeBackupPrivilege 2668 wmic.exe Token: SeRestorePrivilege 2668 wmic.exe Token: SeShutdownPrivilege 2668 wmic.exe Token: SeDebugPrivilege 2668 wmic.exe Token: SeSystemEnvironmentPrivilege 2668 wmic.exe Token: SeRemoteShutdownPrivilege 2668 wmic.exe Token: SeUndockPrivilege 2668 wmic.exe Token: SeManageVolumePrivilege 2668 wmic.exe Token: 33 2668 wmic.exe Token: 34 2668 wmic.exe Token: 35 2668 wmic.exe Token: SeIncreaseQuotaPrivilege 2668 wmic.exe Token: SeSecurityPrivilege 2668 wmic.exe Token: SeTakeOwnershipPrivilege 2668 wmic.exe Token: SeLoadDriverPrivilege 2668 wmic.exe Token: SeSystemProfilePrivilege 2668 wmic.exe Token: SeSystemtimePrivilege 2668 wmic.exe Token: SeProfSingleProcessPrivilege 2668 wmic.exe Token: SeIncBasePriorityPrivilege 2668 wmic.exe Token: SeCreatePagefilePrivilege 2668 wmic.exe Token: SeBackupPrivilege 2668 wmic.exe Token: SeRestorePrivilege 2668 wmic.exe Token: SeShutdownPrivilege 2668 wmic.exe Token: SeDebugPrivilege 2668 wmic.exe Token: SeSystemEnvironmentPrivilege 2668 wmic.exe Token: SeRemoteShutdownPrivilege 2668 wmic.exe Token: SeUndockPrivilege 2668 wmic.exe Token: SeManageVolumePrivilege 2668 wmic.exe Token: 33 2668 wmic.exe Token: 34 2668 wmic.exe Token: 35 2668 wmic.exe Token: SeIncreaseQuotaPrivilege 2620 wmic.exe Token: SeSecurityPrivilege 2620 wmic.exe Token: SeTakeOwnershipPrivilege 2620 wmic.exe Token: SeLoadDriverPrivilege 2620 wmic.exe Token: SeSystemProfilePrivilege 2620 wmic.exe Token: SeSystemtimePrivilege 2620 wmic.exe Token: SeProfSingleProcessPrivilege 2620 wmic.exe Token: SeIncBasePriorityPrivilege 2620 wmic.exe Token: SeCreatePagefilePrivilege 2620 wmic.exe Token: SeBackupPrivilege 2620 wmic.exe Token: SeRestorePrivilege 2620 wmic.exe Token: SeShutdownPrivilege 2620 wmic.exe Token: SeDebugPrivilege 2620 wmic.exe Token: SeSystemEnvironmentPrivilege 2620 wmic.exe Token: SeRemoteShutdownPrivilege 2620 wmic.exe Token: SeUndockPrivilege 2620 wmic.exe Token: SeManageVolumePrivilege 2620 wmic.exe Token: 33 2620 wmic.exe Token: 34 2620 wmic.exe Token: 35 2620 wmic.exe Token: SeIncreaseQuotaPrivilege 2952 wmic.exe Token: SeSecurityPrivilege 2952 wmic.exe Token: SeTakeOwnershipPrivilege 2952 wmic.exe Token: SeLoadDriverPrivilege 2952 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2552 2112 15ccba874c14df1783540edc55843666_JaffaCakes118.exe 28 PID 2112 wrote to memory of 2552 2112 15ccba874c14df1783540edc55843666_JaffaCakes118.exe 28 PID 2112 wrote to memory of 2552 2112 15ccba874c14df1783540edc55843666_JaffaCakes118.exe 28 PID 2112 wrote to memory of 2552 2112 15ccba874c14df1783540edc55843666_JaffaCakes118.exe 28 PID 2552 wrote to memory of 2668 2552 1431799351.exe 29 PID 2552 wrote to memory of 2668 2552 1431799351.exe 29 PID 2552 wrote to memory of 2668 2552 1431799351.exe 29 PID 2552 wrote to memory of 2668 2552 1431799351.exe 29 PID 2552 wrote to memory of 2620 2552 1431799351.exe 32 PID 2552 wrote to memory of 2620 2552 1431799351.exe 32 PID 2552 wrote to memory of 2620 2552 1431799351.exe 32 PID 2552 wrote to memory of 2620 2552 1431799351.exe 32 PID 2552 wrote to memory of 2952 2552 1431799351.exe 34 PID 2552 wrote to memory of 2952 2552 1431799351.exe 34 PID 2552 wrote to memory of 2952 2552 1431799351.exe 34 PID 2552 wrote to memory of 2952 2552 1431799351.exe 34 PID 2552 wrote to memory of 2456 2552 1431799351.exe 36 PID 2552 wrote to memory of 2456 2552 1431799351.exe 36 PID 2552 wrote to memory of 2456 2552 1431799351.exe 36 PID 2552 wrote to memory of 2456 2552 1431799351.exe 36 PID 2552 wrote to memory of 2580 2552 1431799351.exe 38 PID 2552 wrote to memory of 2580 2552 1431799351.exe 38 PID 2552 wrote to memory of 2580 2552 1431799351.exe 38 PID 2552 wrote to memory of 2580 2552 1431799351.exe 38 PID 2552 wrote to memory of 1036 2552 1431799351.exe 40 PID 2552 wrote to memory of 1036 2552 1431799351.exe 40 PID 2552 wrote to memory of 1036 2552 1431799351.exe 40 PID 2552 wrote to memory of 1036 2552 1431799351.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\15ccba874c14df1783540edc55843666_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15ccba874c14df1783540edc55843666_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1431799351.exeC:\Users\Admin\AppData\Local\Temp\1431799351.exe 1|8|2|3|9|7|7|6|5|8|1 LkhHQTQsKSwtGC5STUBNQD02KhsnTURMVUxJREI+OCgfLjxHUEtCPTctLzE2Kh4sOkI9NysYLk9KTUFMPE1ZRDw8MC43MRcoTD9NTkRRV1NPQzZhbm9oOS4ncW9tJz0/TkMsU0dOKjhJSShERkVOGC1AQ0I8RUQ8PHYpNjU5REkuLEpLMztBNkJALDwuTUVDSx4sOyo2KywoLzIYLUEpNiYrGydDMjUrLhcoPS44JTAfJ0IyNCYqGipIUU48U0BLWElMRE5AQlE7HSZJS0k/TUJTV0NSQzo2GipIUU48U0BLWEc7SD08HydDVTxYTkxHNR8uPVZCVjxGPkdBTUQ1Hiw/SExOWjpRTk9RQkk2KRoqTEdARklWRk5YT01EPB8nVEo0KxkpP0swPBgtT0xHTUNIPV5WPUpARkY+Q0g5RkRNUEk0GShDTldRVEZSRkQ+Nm5tbWQfJ1BCS05LSERGRl5NUUJJWD07VEs8MRgtRUA9PlI4KR8uQVFcO1JHO0hBQl49TEBJUklOQDw8ZVlqcFwZKD5KT01LRz9BVkJJNzEuLTAoMCstJysqKxguU0FLQjQqLS0sMC82KzIwFyg9SVJGS045QlxLQkY/OC0uMC4tLycqLiQzMjA0MjIwIUlGGipNQDxFbXdgZWVbICplNCYuKB9QYmhfZ3ZyI0xRIi8nLSArYSpPZ2stLR4tXSN3NSwjMFkkTWxkXGRtbCMvXTAnKiArYSpqdCIqWiorKSgoKmRnaFwkQF9eY24fJ1NPQzZhbm9oJDJZIy9dHitgYl1zMCYuLigqXV9uYWZtJmdrXWgeLGFKdG1MZ2pcPWhxaWRuYFxLXmVaYF9tV2NkaGpscB4rYCwsMjAwLjQqLSwfLV5jbm9saWZaXWdcZmBmXXAiKV8qLi4pNy8vMTEqHixgMS00LywzNCwsKSpUT0F1THhKbUhAbTFFeUBrSlA9ZEhNK29LU0l3R2RSLUY/UTBLcDdtRmM6Z1NhdjNFUS1pREwuZVJDSCtJQG5mUj0vKkpCLGtXOi0tRT89aFdxMjFCYz5nVD9RbVJVbVpTZjsxWzFVbWFEamZRLF9hV2xgblc7XXJGP18vT01QSURNP01NYTckKmBOcU9ASz4sJDFeSy5NOkkqL2VZVS1tXktocg==2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714880161.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714880161.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714880161.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714880161.txt bios get version3⤵PID:2456
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714880161.txt bios get version3⤵PID:2580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 3683⤵
- Loads dropped DLL
- Program crash
PID:1036
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
788KB
MD5345ca014b03f2ddd5c0a5632bcedbaf7
SHA16b56b46e96c2899c69d2fd49cd1f7223fd02120a
SHA25677131302b75e2a2b33446713e6ce8c7a79380a1df8be31ca8eca63f2b3ad7ea3
SHA5121dfcfa33b684e11a3393b8190a39e667593f13a5e9852d2069eb362caf8ff287cf3b0f34b4abe5ea86b75eeb082458a9da7541fc773a1a3ed1710eb96ab4e170
-
Filesize
153KB
MD50ec43130a05cbe9a126c50efc3d2771d
SHA1360e4dd81a32aecd3fb4cab67b8cc786f41fa2dd
SHA256f1f2d35cd64a8b1faf3bb5260d2d18b5e1c22b28b4c9b30a215bd39b626d77ed
SHA512d2d19dfc18051fab5f449b071206d9d5a73d41d8b7e91e42056de20ae0208d8b957272d068f5e2b12faefd2b3456874dd2f682b14f505a6d5cec9d44781f5b14
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5