Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 22:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
266292080bbba5b1f2e03d0a82426ac3_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
266292080bbba5b1f2e03d0a82426ac3_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
266292080bbba5b1f2e03d0a82426ac3_JaffaCakes118.exe
-
Size
136KB
-
MD5
266292080bbba5b1f2e03d0a82426ac3
-
SHA1
29dff12cd9ae389d1328d7d47437deebd564092a
-
SHA256
eb0c944e1325de5859e5a2bd08f1c2e4b1b55b36daff121d1702dec931c2fc06
-
SHA512
855b6fffde48be31f7df7f394e3cdd84a70938abb892f1a1ce55c5e3018e2252a564e34183fa95057a42f00dbf9cd01348d322729ee4f5661077458bdea34519
-
SSDEEP
1536:NhmqXOTy6npK9x5WPjeATvbtjYYVHdzqZgIYEOCozOZD:yqX8jI93WPyAdYZgI2CozAD
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" heuepe.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Control Panel\International\Geo\Nation 266292080bbba5b1f2e03d0a82426ac3_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2616 heuepe.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /t" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /f" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /T" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /e" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /Q" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /o" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /P" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /n" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /V" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /p" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /G" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /g" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /a" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /S" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /N" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /M" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /E" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /s" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /K" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /H" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /u" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /Y" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /x" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /i" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /I" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /w" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /q" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /J" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /W" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /h" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /F" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /m" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /L" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /l" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /B" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /j" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /R" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /O" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /D" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /k" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /Z" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /z" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /y" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /b" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /A" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /r" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /X" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /c" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /v" heuepe.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heuepe = "C:\\Users\\Admin\\heuepe.exe /C" heuepe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe 2616 heuepe.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1288 266292080bbba5b1f2e03d0a82426ac3_JaffaCakes118.exe 2616 heuepe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 2616 1288 266292080bbba5b1f2e03d0a82426ac3_JaffaCakes118.exe 83 PID 1288 wrote to memory of 2616 1288 266292080bbba5b1f2e03d0a82426ac3_JaffaCakes118.exe 83 PID 1288 wrote to memory of 2616 1288 266292080bbba5b1f2e03d0a82426ac3_JaffaCakes118.exe 83 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79 PID 2616 wrote to memory of 1288 2616 heuepe.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\266292080bbba5b1f2e03d0a82426ac3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\266292080bbba5b1f2e03d0a82426ac3_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\heuepe.exe"C:\Users\Admin\heuepe.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD57839b323159cd736a7e581bd368bd176
SHA120c28ab9d981c1b09e0f6de259deb6e2ebca8c9c
SHA256123ac09f8abf26119bb55a6e07560648da95f59196a9c726d6ec04b5bef6d0e7
SHA512eaefd43f897574689fd37979311ef0081014860dd7b21e63520c826fe99fa5fc192afedee6e2971bb8252ec0cbed1f168198a1cc30032967db8d89b988667217