Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7a432ee3b6e...18.exe
windows7-x64
7a432ee3b6e...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...rb.dll
windows7-x64
3$PLUGINSDI...rb.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...la.rtf
windows7-x64
4$PLUGINSDI...la.rtf
windows10-2004-x64
1$PLUGINSDI...ay.dll
windows7-x64
7$PLUGINSDI...ay.dll
windows10-2004-x64
7$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ML.dll
windows7-x64
3$PLUGINSDI...ML.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows7-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$R1/$_1_/U...ll.exe
windows7-x64
7$R1/$_1_/U...ll.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 06:28
Behavioral task
behavioral1
Sample
a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InvokeShellVerb.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InvokeShellVerb.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/ask_eula.rtf
Resource
win7-20240419-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/ask_eula.rtf
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsArray.dll
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsArray.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsisXML.dll
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsisXML.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/registry.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
$R1/$_1_/Uninstall.exe
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
$R1/$_1_/Uninstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240419-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240508-en
General
-
Target
a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
a432ee3b6e3418a08d65779da9e63628
-
SHA1
b3d2b2eab0e2f37ee8f28c6920c50f0e657ec020
-
SHA256
14066f289048cfc6fae3021d7517586b3d738e462516e97dc62a93ce58a1270a
-
SHA512
dbd4375e15845d4a5b54b6e4dcf92fdb6d675a40b42d82889eb04b329f92a233ccfbebe4429227937bfdb41b2f3a8bd0017bc0e422e1e16997d0703104ea6ef2
-
SSDEEP
24576:Yjr58BA/wkw8IPNXOi411TpUFa4EO3g152nlAo81gi3s6eBSancEZaDFlzLjP9C1:swd934jtUdE3valA4sDSzcWa7jFC9f/
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 920 a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe 920 a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe 920 a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe 920 a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe 920 a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe 920 a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe 920 a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe\IsHostApp a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 920 a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe 920 a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 920 a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 920 a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe 920 a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a432ee3b6e3418a08d65779da9e63628_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
13KB
MD5a88baad3461d2e9928a15753b1d93fd7
SHA1bb826e35264968bbc3b981d8430ac55df1e6d4a6
SHA256c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
SHA5125edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
-
Filesize
4KB
MD5c7ce0e47c83525983fd2c4c9566b4aad
SHA138b7ad7bb32ffae35540fce373b8a671878dc54e
SHA2566293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
SHA512ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
-
Filesize
1.8MB
MD5782cc7c471a648566a523d8497c0c14c
SHA1600406959ce8a9a34c9d8af7013a4e00cb87e534
SHA256f3ad6e5c3965801777fc5b3155a190ed72e216ec70cd4917d147d6ec22f24e63
SHA5120fcaef7aa32249fcb9d45e6b8f4d763885ce507e311e2d5b4142705aeeb63db0e718145b08c0e8d7477a9d9c20b38234a0011203021f65c605a460b7c3b4b69f
-
Filesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
Filesize
24KB
MD52b7007ed0262ca02ef69d8990815cbeb
SHA12eabe4f755213666dbbbde024a5235ddde02b47f
SHA2560b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
SHA512aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
-
Filesize
194KB
MD5cf9493ebb178d9fc48a35bf9846528c4
SHA1b0350c311f387238452a7a0d6b0ec04ff7b3ef09
SHA2562e548baf9a3dc6dd3269753b843cd5ffba85e4cf03743f7efb1f3a814e881568
SHA5125a0f6f6d625a4c3c69bab68c1c839620cbc79929967c94b55de9b972bc687a28ba10a85adab080b630bc2afb51554d5278f2d4fcde1eb89034e04d3545a520f6