Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/06/2024, 23:58
Behavioral task
behavioral1
Sample
04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
04ccf0e82bcef6ac962066582de10cf8
-
SHA1
ca26d12266bb197e350e6d7b142f85b5c4bb721b
-
SHA256
92e2fc19cc1cf1cf17e0746ffe625103d1285af13870a0848afd8482ee2f6518
-
SHA512
e875f9bd2441ac8e117ff44d5610980ed93882c038962784aa13e86b0bb8c9eb56d77143eb278c1b15d22382fa1625c523a80a8974f8240624535893e69b1a9c
-
SSDEEP
24576:qfTqlXxhVv0SC/4VbALSIv+mbEclKxNvXbzugMquaSmQTYeH1UJK0Sd:qLSJv0SCABA+W+mbdlKXaNLaM5Vc9U
Malware Config
Signatures
-
Drops file in System32 directory 25 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\yytmp1\ywsinid.files\25.bmp 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\yytmp1\2352235877\2352235877.tmp 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\opfileOneA 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\opfileOneA 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\yyhelp.yws 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\yytmp1\2352235877\fj2352235877.tmp 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\yytmp1\ywsfiletmp.tmp 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\yytmp1\2352235877\lk2352235877.tmp 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\yytmp1\2352235877\mu2352235877.tmp 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\opfilejlA 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\yytmp1\ÓÑÒæÎÄÊé.exe 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\syys7.1.1.syw 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\ÓÑÒæÎÄÊé.exe 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\opfilejlA 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\yytmp1\2352235877\sx2352235877.tmp 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\yytmp1\2352235877\2352235877.tmp 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\yytmp1\2352235877\lk2352235877.tmp 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\yytmp1\2352235877\sx2352235877.tmp 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\yytmp1\2352235877\mu2352235877.tmp 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\ÓÑÒæÎÄÊé.exe 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\yytmp1\2352235877\tmp1.doc 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\ywsexe1.exs 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\yytmp1\2352235877\fj2352235877.tmp 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\yytmp1\ÓÑÒæÎÄÊé.exe 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\yytmp1\2352235877\yadviser.tmp 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile\Version\ = "7.1.1" 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile\shell 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile\shell\open\command\ = "c:\\windows\\SysWow64\\ÓÑÒæÎÄÊé.exe %1" 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.8\EditFlags = "65536" 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PowerPoint.Show.8\EditFlags = "65536" 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile\shell\open 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile\shell\open\command 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile\DefaultIcon 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile\DefaultIcon\ = "c:\\windows\\SysWow64\\ÓÑÒæÎÄÊé.exe,1" 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile\isogg = "alrGady" 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\EditFlags = "65536" 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.yws 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.yws\ = "ywsfile" 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile\ = "ÓÑÒæÎÄÊé" 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile\Version 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3316 WINWORD.EXE 3316 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2360 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe 2360 04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe 3316 WINWORD.EXE 3316 WINWORD.EXE 3316 WINWORD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04ccf0e82bcef6ac962066582de10cf8_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2360
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3316