Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
36c2c5d6659...18.exe
windows7-x64
76c2c5d6659...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/glossitis.dll
windows7-x64
1$TEMP/glossitis.dll
windows10-2004-x64
3uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3Analysis
-
max time kernel
6s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 20:33
Static task
static1
Behavioral task
behavioral1
Sample
6c2c5d6659efb231d9ad581c9bc2a98e_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6c2c5d6659efb231d9ad581c9bc2a98e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$TEMP/glossitis.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
$TEMP/glossitis.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
uninstall.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
uninstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240508-en
General
-
Target
6c2c5d6659efb231d9ad581c9bc2a98e_JaffaCakes118.exe
-
Size
436KB
-
MD5
6c2c5d6659efb231d9ad581c9bc2a98e
-
SHA1
feab504fed043f6c76af14a090496b19fef75f44
-
SHA256
96e0f2a803195e87752de63e91566dfe74b565d80e3c36efd90d85ec1b3be632
-
SHA512
da89c4d71aa5251dd94e382488cc35ed23893c8c0fe7bf724108acde6775ed63db01f621337cc8c7f291c9b380769452f9558379ff391729f2dbe507747d9ace
-
SSDEEP
12288:ZnISpUE+pgz1ON4gwT+tBMjFzrAyxA46elD0I0/UiQTN:ySOE+pgAuOcz7Ak0/UiW
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4556 1212 WerFault.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c2c5d6659efb231d9ad581c9bc2a98e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6c2c5d6659efb231d9ad581c9bc2a98e_JaffaCakes118.exe"1⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\6c2c5d6659efb231d9ad581c9bc2a98e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6c2c5d6659efb231d9ad581c9bc2a98e_JaffaCakes118.exe"2⤵PID:1212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 6803⤵
- Program crash
PID:4556
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4180,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:81⤵PID:3024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1212 -ip 12121⤵PID:428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD538e1a078aaf0a8feea3d3a6317b6e85e
SHA15b35cbdd235366eac93d409e7b5cfe43db444f64
SHA256c193d53bc725e9ddcea48506f4f48bea90e665fa145a12ac1a6d1ddd0f6e113b
SHA5122b7987f4598d9831e3f53182117e0ca49ead034358211b8fe5ae13377d9950591bf87468c12e315caf575db82cc5d0c46f0d67059d340d4fe2543dba0bc98c35
-
Filesize
11KB
MD5a436db0c473a087eb61ff5c53c34ba27
SHA165ea67e424e75f5065132b539c8b2eda88aa0506
SHA25675ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d