Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 04:53
Static task
static1
Behavioral task
behavioral1
Sample
1610a1baa2327aacdd625ac9cea6f2b8_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1610a1baa2327aacdd625ac9cea6f2b8_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
1610a1baa2327aacdd625ac9cea6f2b8_JaffaCakes118.exe
-
Size
905KB
-
MD5
1610a1baa2327aacdd625ac9cea6f2b8
-
SHA1
dc90be6ba647911f51ac75573bfa06ef8666e4db
-
SHA256
226d4f9bc4b1acc7b293f8fe4709c1f07ebf75bc66fa4857d68cd26fe1160f5e
-
SHA512
91c725ee93b98f59f0c1ef131221932c03356f1fcf738581af154bec180327ad6f4223cae5351d8e334833477cfae6665f5bfc1c73eebc42e9b5beae8904aeaf
-
SSDEEP
12288:TKKkF1X10ZhaJfC5/cnGLeb8fe6Owhky95g1xGkg1aFSkYu8DU0OYhLu0O49g3k:eKOXuhaJfo/da6OwZy1kkui6uKVOZk
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation 1610a1baa2327aacdd625ac9cea6f2b8_JaffaCakes118.exe -
Executes dropped EXE 3 IoCs
pid Process 3092 minidownload.exe 5012 DownLoadDlg.exe 3492 ExceptionReport.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 1610a1baa2327aacdd625ac9cea6f2b8_JaffaCakes118.exe File opened for modification \??\PhysicalDrive0 DownLoadDlg.exe -
Drops file in Program Files directory 33 IoCs
description ioc Process File created C:\Program Files (x86)\SogouDownLoad\html\images\errorbg2.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\progressbar.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\crash\ExceptionReport.exe minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\download.html minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\btn_spr.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\error2.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\ico_close.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\ico_set.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\settings.html minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\btns.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\dlico.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\error.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\ico_spr.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\attention.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\bg_line.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\img_exe.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\config.ini minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\rocket1.swf minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\rocket2.swf minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\warning.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\js\swfobject.js minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\css\downloader.css minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\dlbg.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\ico_t.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\ico_min.gif minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\js\actions.js minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\repair.html minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\css\down.css minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\js\jquery-1.11.2.min.js minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\check.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\dlico1.png minidownload.exe File created C:\Program Files (x86)\SogouDownLoad\html\images\errorbg1.png minidownload.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x000c000000023b52-2.dat nsis_installer_1 behavioral2/files/0x000c000000023b52-2.dat nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5012 DownLoadDlg.exe 5012 DownLoadDlg.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5012 DownLoadDlg.exe 5012 DownLoadDlg.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3948 wrote to memory of 3092 3948 1610a1baa2327aacdd625ac9cea6f2b8_JaffaCakes118.exe 84 PID 3948 wrote to memory of 3092 3948 1610a1baa2327aacdd625ac9cea6f2b8_JaffaCakes118.exe 84 PID 3948 wrote to memory of 3092 3948 1610a1baa2327aacdd625ac9cea6f2b8_JaffaCakes118.exe 84 PID 3948 wrote to memory of 5012 3948 1610a1baa2327aacdd625ac9cea6f2b8_JaffaCakes118.exe 88 PID 3948 wrote to memory of 5012 3948 1610a1baa2327aacdd625ac9cea6f2b8_JaffaCakes118.exe 88 PID 3948 wrote to memory of 5012 3948 1610a1baa2327aacdd625ac9cea6f2b8_JaffaCakes118.exe 88 PID 5012 wrote to memory of 3492 5012 DownLoadDlg.exe 94 PID 5012 wrote to memory of 3492 5012 DownLoadDlg.exe 94 PID 5012 wrote to memory of 3492 5012 DownLoadDlg.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\1610a1baa2327aacdd625ac9cea6f2b8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1610a1baa2327aacdd625ac9cea6f2b8_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\minidownload.exeC:\Users\Admin\AppData\Local\Temp\\minidownload.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3092
-
-
C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe"C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe" /Install?status=true&softurl=https%3A%2F%2Fxiazai.sogou.com%2Fcomm%2Fredir%3Fsoftdown%3D1%26u%3D5M778mNuk-Kn5im16Xqufpm73IcE-aIs4gcvPL07TEJ86hRHz3mToT_ePZtTrYvi7YQ-v76q1eLZ-feXkpKDG8uqxplQrsbk%26pcid%3D562185221852419207%26fr%3Dxiazai%26source%3Dtencent%26filename%3Dediary_v30final.zip&iconurl=http%3A%2F%2Fpc3.gtimg.com%2Fsoftmgr%2Flogo%2F48%2F161020_48_1387967396.png&softname=%E7%94%B5%E5%AD%90%E6%97%A5%E8%AE%B0%E6%9C%AC&softsize=4.79MB2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Program Files (x86)\SogouDownLoad\crash\ExceptionReport.exe"C:\Program Files (x86)\SogouDownLoad\crash\ExceptionReport.exe" "dump202405050453"3⤵
- Executes dropped EXE
PID:3492
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
786KB
MD53f1eae76cd9e2cd1d6c1fa9b3ad2df9a
SHA15066a259189ba2181969accd7f71d17f38591de7
SHA2563c987155a155ae4603760f471eaab1bbb130471fb3f47127283da9070ea23a5f
SHA5122d56933e707d622badd819405bb905037557a5a23b647bb9033d67c8719aa8cf9b56f0185bd2efccec857b7f3573689c35732af1f83998a943373cc8ca29f7c1
-
Filesize
111KB
MD5ba7121a86dbffafc97e1b8c11c17e199
SHA1922e584be46621e0ab57d3bb47b7c5dee8230ea8
SHA2560bc616a788f782a37b8fb0134ffabdd8a2988205a125b2f400c3deb43e2a8971
SHA51222641abfa34f8ed5c24375b221b6cae935fadffb4b1cf9f8c452658538dd4af459ec7e6a95d05fb7b3aa0fcb4bd195fa18d6fe787ece282fa5c5a8187da76197
-
Filesize
116B
MD5ffa1443199298e2c4ff1122f1ae14b05
SHA196175a64c1f8ba142aa057e8f76e13467ecefb82
SHA2562d21ddb94831d5345bbfbe52ecd342067cf49c6eaf8c78057e1901b6c69c6574
SHA5123955846ed694c43d2d9857168e1c3fee9714ecea70c0af04b1db6d7be5b4805b92730d74bc4a74ed5464c47e4af558b8d040d0efc8ec276fcb8c50c346fe61de
-
Filesize
7KB
MD50079cdb145c388c3e4c5e2235ac97bce
SHA17a8fee29992183dd572c52a1f6ca24219f4d8cba
SHA256f4890eb5df2bb1b2921c0e561388780b4e2871998ca5aa7f4ec8bbf6ea1a715c
SHA5127387d097152a49f8c57db203d89f64f6d2f905b60f69fa90d26ee3ebcab6428865e745fca63600c724c296db85d299502b4133cacd4b7dbcd4653712a82caa46
-
Filesize
7KB
MD5382c18d88309c186f501dc3d31876461
SHA11c602b521deec4e2826e9280fed7e586351282c4
SHA25667293d69f293e3347dd6eaabf19b84d3bba0fbc00fcc19d79be354da3f105687
SHA512f82ba3616734551eef1239203cc09531280f1c9118edc1f1218c18247c13dc3455e7d783f440a919a1df47922d33ed8526deabd979fe4d12e6cef2a5707c045d
-
Filesize
657B
MD50e0ac8352cd69f396f271fa32f3ab554
SHA1ed6d306a5033707f45477df3318a53d15b47cf43
SHA256c2c34d6bf4e17b756954e409dc9b5663169d68997abd722ce1e86473b769f10c
SHA5125d2528489c21600f16f04559500be3ebe9db5a1dc7bf9abc9c1312187b4b8b7bc5966f9eb2a38e26bff26c854a6d964fa156641fed9501cf0e7befedb60fd7e0
-
Filesize
8KB
MD53b4a5f925a08bd18b636880b8d557077
SHA173ed8c3697681e7999bae4fdcc62867b263182ce
SHA25648b8718ba8de855d6c937b23eb7ccc4f5482e6619de9261324c12a48ae6769dc
SHA512aa5ffd3040a6eb964ed7c70d138e3201989f78551610e22585077fa86bff58740500d6309c339a2dded56481d04f7416ca97b22548fde4661f7da39c9600644b
-
Filesize
93KB
MD55790ead7ad3ba27397aedfa3d263b867
SHA18130544c215fe5d1ec081d83461bf4a711e74882
SHA2562ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
SHA512781acedc99de4ce8d53d9b43a158c645eab1b23dfdfd6b57b3c442b11acc4a344e0d5b0067d4b78bb173abbded75fb91c410f2b5a58f71d438aa6266d048d98a
-
Filesize
10KB
MD5631f38cfac458788af482eba736e5ac3
SHA1b1d09def39ec74eff2c9e0aafe0a7c12e7650150
SHA25613e6cf03cdd65a8174cce7b0cb40c9821d2aff04a79c3374e8664fb0abb5694d
SHA5123ae47c895cd586b1dca8bdf65c58bc896b27837881cc42bb7b3d55c9a71ea9e857939a69c5146b445b64714996393d1ec9c0d95b18d18fd5cb48f02bb8a53f42
-
Filesize
106KB
MD5149f4b68a7fbfc3e817d2300d0c6e8eb
SHA1f1e9926aac358a9831e1e260cefe031e73011d28
SHA25680410a4be7954a672135126cd60fb28f390d76f6a495d42bfc35ae1e7bb12a7c
SHA512ad09b1eaf201dfc6c076cbc56eb983cee8aa6d1491f6b3f87bd42fc241a269ed3c405132411a0c9eee77398f6366d45f032cfb80c7ac996b03fbe9ba3e5ae8fa
-
Filesize
35KB
MD55b0c2cbb754d8f4bee4e825e1eddac8e
SHA1856213d242e1c57675dbdfa62092410ae4f3c326
SHA256c881ad6e4c5e26ce056d7a8372a591cebe5831222ea6e2c4dd63477dbf8417fc
SHA5124555d53e94071d267afdd13faaadc66daca768f9ae64232ca960befcfbf15247abb0fde333e056a4dd64ff645e5cb096fa1bd509f50734210f3ee4a989624f8d
-
Filesize
496KB
MD50aaf56d69b9f7976df9199c43d50c46e
SHA1ff5aae9855bcc1dd22cce8b9bb658aece7c700d3
SHA2568ff183757f031c449463b8e02d30157b029cea3e9a05770a4891c24d7cb398b5
SHA5126b5b8d1be7fd78a0eaa2025c53c6760191752c3ec8a2336b1c12bec713f1c0a8b02163c8f47ab3d310033f6bac3c76ba967ff88d82f4787524f1f9f25f63c677