Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
74cfa772413...18.exe
windows7-x64
74cfa772413...18.exe
windows10-2004-x64
7$PLUGINSDI...er.exe
windows7-x64
7$PLUGINSDI...er.exe
windows10-2004-x64
7$PLUGINSDI...BI.exe
windows7-x64
3$PLUGINSDI...BI.exe
windows10-2004-x64
3$PLUGINSDI...cc.exe
windows7-x64
7$PLUGINSDI...cc.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ed.htm
windows7-x64
1$PLUGINSDI...ed.htm
windows10-2004-x64
1$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...lp.dll
windows7-x64
1$PLUGINSDI...lp.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows7-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...ay.dll
windows7-x64
7$PLUGINSDI...ay.dll
windows10-2004-x64
7$PLUGINSDI...te.exe
windows7-x64
7$PLUGINSDI...te.exe
windows10-2004-x64
7$PLUGINSDI...st.dll
windows7-x64
1$PLUGINSDI...st.dll
windows10-2004-x64
3$PLUGINSDIR/xml.dll
windows7-x64
3$PLUGINSDIR/xml.dll
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 21:00
Behavioral task
behavioral1
Sample
4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/$_354_/ProxyInstaller.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/$_354_/ProxyInstaller.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/$_355_/BI.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/$_355_/BI.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/$_356_/DownloadAcc.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/$_356_/DownloadAcc.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/BunndleOfferManager.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/BunndleOfferManager.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/Failed.htm
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/Failed.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/FirefoxHandler.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/FirefoxHandler.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/OCSetupHlp.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/OCSetupHlp.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/execDos.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/execDos.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsArray.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsArray.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/wajam_validate.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/wajam_validate.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/webapphost.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/webapphost.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/xml.dll
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/xml.dll
Resource
win10v2004-20240508-en
General
-
Target
4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
4cfa77241309f09eb0a9cb69c0319347
-
SHA1
fd5d89fdba0973dff9267c7ba3d45c3491c3dc24
-
SHA256
221b160532a8bd6357a78ab2dadbfb74a9101c030362ea6b5e1a06a7a38f4efc
-
SHA512
3f5d632c3d5d363764ca8c65e632c043eb4025f2bc642e08b6f7a6fdaf6c3e7f645e029f144dded1c9443b2926a48b299296e568258b5b44227b390807307fa5
-
SSDEEP
24576:G8IF5Hr6yALUQhj2XltNwHs3kB4Z2m/0Y94pLikcZZep0/tty:jgNjAL92XhSs3r7/0+4pLitZep0Hy
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2936 BI.exe 2332 BI.exe 372 BI.exe -
Loads dropped DLL 18 IoCs
pid Process 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2936 BI.exe 2936 BI.exe 2936 BI.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2332 BI.exe 2332 BI.exe 2332 BI.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 372 BI.exe 372 BI.exe 372 BI.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2936 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 29 PID 2976 wrote to memory of 2936 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 29 PID 2976 wrote to memory of 2936 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 29 PID 2976 wrote to memory of 2936 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 29 PID 2976 wrote to memory of 2332 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 32 PID 2976 wrote to memory of 2332 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 32 PID 2976 wrote to memory of 2332 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 32 PID 2976 wrote to memory of 2332 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 32 PID 2976 wrote to memory of 372 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 33 PID 2976 wrote to memory of 372 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 33 PID 2976 wrote to memory of 372 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 33 PID 2976 wrote to memory of 372 2976 4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4cfa77241309f09eb0a9cb69c0319347_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\nsy63A.tmp\BI\BI.exeC:\Users\Admin\AppData\Local\Temp\nsy63A.tmp\BI\BI.exe { "json_send_time" : "16/5/2024 23:0:31:823" , "phase_type" : "regular" , "show_languages_combo" : "0" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "864898" , "user_type" : "NULL" , "result" : "Success" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.4.131024.02" , "bundle_id" : "36cbdf28-356d-4d1c-b3c9-9050c3d1540a" , "machine_user_id" : "FDMEUAVIBXDJVOIG5S3EFR93EK4BKJZJFIVNKZ/WJJALUBU4XIQG0FRRNUJSZGUWB9BDZS/1CHN4J2J5LJNOZA" , "send_attempt" : "0" , "user_browser_version" : "" , "user_browser" : "" , "stub_version" : "no_stub" , "activated_by_stub" : "0" , "channel_id" : "" , "installation_session_id" : "5F2FEE4D-2618-4140-898C-273388A5381A" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "A-1477560" , "order" : "1.0" , "phase" : "Init" , "Is_Test" : "0" }2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\nsy63A.tmp\BI\BI.exeC:\Users\Admin\AppData\Local\Temp\nsy63A.tmp\BI\BI.exe { "user_ie_security_level" : "Medium-High" , "json_send_time" : "16/5/2024 23:1:7:625" , "phase_type" : "regular" , "internal_error_description" : "HttpPost result: try1- SendRequest Error (Err=0); try2- SendRequest Error (Err=0) (Err=0); try3- SendRequest Error (Err=0) (Err=0) (Err=0)" , "internal_error_number" : "3" , "is_parallel" : "0" , "mrs_id" : "" , "vector_id" : "" , "rule_id" : "" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "864898" , "general_status_code" : "2" , "duration_details" : " InitPluginsDir:0 initializeParams:312 load_BITool:0 send_BI_Init:31 load_DownloadACC:15 retrieveUISource:0 unpack_webappfolder:0 unpack_icon:0 RetrieveMainOfferKey:0 unpack_OpenCandyDll:32 unpack_BunndleDll:15 load_webapphost:0 unpack_ProxyInstaller:16 navigate_loadingUI:515 navigateAsync_constMainOffer:0 BuildUserProfile:0 retrieve cid:0 callService1:12074 callService1:11575 callService1:11544 " , "phase_duration" : "" , "error_details" : "Failed communicate with the DistributionEngineService. Inner Error: SendRequest Error (Err=0) (Err=0) (Err=0) InternalRetryNum: 3" , "result" : "Error" , "user_operating_system_bits" : "64" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "4.0" , "user_acount_type" : "" , "user_ie_version" : "9.11.9600.16428" , "user_default_browser_version" : "9.11.9600.16428" , "user_default_browser" : "IEXPLORE.EXE" , "user_service_pack" : "1.0" , "user_operating_system" : "Windows 7 Ultimate" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.4.131024.02" , "bundle_id" : "36cbdf28-356d-4d1c-b3c9-9050c3d1540a" , "machine_user_id" : "FDMEUAVIBXDJVOIG5S3EFR93EK4BKJZJFIVNKZ/WJJALUBU4XIQG0FRRNUJSZGUWB9BDZS/1CHN4J2J5LJNOZA" , "send_attempt" : "0" , "user_browser_version" : "" , "user_browser" : "" , "stub_version" : "no_stub" , "activated_by_stub" : "0" , "channel_id" : "" , "installation_session_id" : "5F2FEE4D-2618-4140-898C-273388A5381A" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "A-1477560" , "order" : "2.0" , "phase" : "InitComplete" , "Is_Test" : "0" }2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332
-
-
C:\Users\Admin\AppData\Local\Temp\nsy63A.tmp\BI\BI.exeC:\Users\Admin\AppData\Local\Temp\nsy63A.tmp\BI\BI.exe { "json_send_time" : "16/5/2024 23:1:10:636" , "phase_type" : "technical" , "error_details" : "Error in displaying the Error offer UI. Internal error: No answer on Failed page" , "result" : "Error" , "user_operating_system_bits" : "64" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "4.0" , "user_acount_type" : "" , "user_ie_version" : "9.11.9600.16428" , "user_default_browser_version" : "9.11.9600.16428" , "user_default_browser" : "IEXPLORE.EXE" , "user_service_pack" : "1.0" , "user_operating_system" : "Windows 7 Ultimate" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.4.131024.02" , "bundle_id" : "36cbdf28-356d-4d1c-b3c9-9050c3d1540a" , "machine_user_id" : "FDMEUAVIBXDJVOIG5S3EFR93EK4BKJZJFIVNKZ/WJJALUBU4XIQG0FRRNUJSZGUWB9BDZS/1CHN4J2J5LJNOZA" , "send_attempt" : "0" , "user_browser_version" : "" , "user_browser" : "" , "stub_version" : "no_stub" , "activated_by_stub" : "0" , "channel_id" : "" , "installation_session_id" : "5F2FEE4D-2618-4140-898C-273388A5381A" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "A-1477560" , "phase" : "Failed" , "Is_Test" : "0" }2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD54bca38bc78f5e8283655b1dda3d81b2c
SHA1b1e61db910ebc37bcbf4650d773d727b15fc8554
SHA25616b03f64adc522298a636a117869d821379e341314704a4eb7e2263689e76d91
SHA5126b4559f2f658835ca3a5a8772f424415838990fd7b22ce9452577c6f1e92c8776fe8f25e2747e91dcf59b390084d82bc48f3bfaafb242c3374b0e98e81db3509
-
Filesize
65KB
MD50781655ec56f48f0878cf9b8cfb96a26
SHA1b72a9d7e146df7d10a3f1483c9a9d32c224b9fdb
SHA2566122edbae7a047d7ea93fa7cf9383cbefca9e18b571c9f183f9a1bfd6d2faa77
SHA5127d21d5d36bbd25cc63163387f70d4d01c68bbb99c94481ca33f494f4954c7e7e1b02c77d9297892373575751ec9825264b4af926c844f58abfb6a24ead5e1309
-
Filesize
17KB
MD5a4f38d1c7a480f5da1bb8097b8b939db
SHA1b3129c2a0e61881381463f5e0cbbffa573daa845
SHA256e1180e1e3344c7536150275e33de53dc1dd1a3ca03be66c4d4875fe5bcd4e436
SHA512fed89f7ee9364fc2f4b9f82c4563713497043947e98dbb03e7d755681adf3ae661aba80d08e59988a23695fc64481b69d9842b7ec7d2b572cc872c4c9957febc
-
Filesize
68KB
MD53f06f0843792d42062bea6a42ee8ac11
SHA10b054746b414653b1eb87f3a5550ced2b8d41340
SHA2569db2b6fffadd4e383a7aa15d2c15596de12c7e523cc7e38ecf4a909b9196df12
SHA512ea6884f612f973101179f29aeb938789392efb9f592cf6435c7f2d85f1a151cd559818a786341d46fa950fbe0af61fecb1bd6fd04f28b02666d5bdd203c7bffa
-
Filesize
827KB
MD54dc5c6692260f2191e1573dd1cb1bb32
SHA1de77124c49f17798d2b576add2e1857515c35e10
SHA25659f4916771a03fd9836df92196b31256c428fb50a287474359a55dcf03d32632
SHA5129ab8135c7081487c8f9cca70bdb275553e722ac69aa1906af83657eb0ea8459feb0030e3417edff6abd1cce7ee06fc967babbd306e79911f767935db00fa549d