Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 16:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe
-
Size
119KB
-
MD5
270a3519a8e7eb37a61138fd3cb2a552
-
SHA1
0a92d07330d5af6c740820d7a0628ad8b3034a8b
-
SHA256
55e757eeb966e4389ee54fa25bbf401694f6192da5b2796ff6c2d135e8957346
-
SHA512
5830196e3a5479efcfbf6989974bbdea961a9d86a21cb4ad2c9ffb47a649d73695c3a60e7e3b72364195bfcaafe306616b447b3364ee9013ddefcec2ce7e2735
-
SSDEEP
3072:NhyVR3H397BpjsokToH3w1VOJOAmEPgrCA7mEjzZt+V:NEnsPTooOJOLEPzAdtc
Score
9/10
Malware Config
Signatures
-
Renames multiple (216) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 2064 Logo1_.exe 4300 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.Exe Logo1_.exe File created C:\Program Files\7-Zip\Uninstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.41\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.41\MicrosoftEdgeUpdateOnDemand.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe Logo1_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\BGAUpdate.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe File created C:\Windows\Logo1_.exe 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe 2064 Logo1_.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4536 wrote to memory of 3484 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 82 PID 4536 wrote to memory of 3484 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 82 PID 4536 wrote to memory of 3484 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 82 PID 3484 wrote to memory of 1564 3484 net.exe 84 PID 3484 wrote to memory of 1564 3484 net.exe 84 PID 3484 wrote to memory of 1564 3484 net.exe 84 PID 4536 wrote to memory of 3176 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 89 PID 4536 wrote to memory of 3176 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 89 PID 4536 wrote to memory of 3176 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 89 PID 4536 wrote to memory of 2064 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 91 PID 4536 wrote to memory of 2064 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 91 PID 4536 wrote to memory of 2064 4536 270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe 91 PID 2064 wrote to memory of 4156 2064 Logo1_.exe 92 PID 2064 wrote to memory of 4156 2064 Logo1_.exe 92 PID 2064 wrote to memory of 4156 2064 Logo1_.exe 92 PID 4156 wrote to memory of 4592 4156 net.exe 95 PID 4156 wrote to memory of 4592 4156 net.exe 95 PID 4156 wrote to memory of 4592 4156 net.exe 95 PID 2064 wrote to memory of 4464 2064 Logo1_.exe 96 PID 2064 wrote to memory of 4464 2064 Logo1_.exe 96 PID 2064 wrote to memory of 4464 2064 Logo1_.exe 96 PID 4464 wrote to memory of 4084 4464 net.exe 98 PID 4464 wrote to memory of 4084 4464 net.exe 98 PID 4464 wrote to memory of 4084 4464 net.exe 98 PID 2064 wrote to memory of 3424 2064 Logo1_.exe 56 PID 2064 wrote to memory of 3424 2064 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:1564
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a613A.bat3⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe"4⤵
- Executes dropped EXE
PID:4300
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4592
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4084
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
603KB
MD5e06d406678cc8d0e514cb0324f8a1d4b
SHA12111af41f93cad49281476b5341ca2828c055f7c
SHA256be326523a0a393371588ca9af9f34a419f333758bb1d0d90dcfb738da96f4db0
SHA51220fa6757a307ca7d92e0888dc0f1151c91a22758e9f50cd80c352e08f441a4d0160cebf1c67057bf7817a582b9f77b6704858f96e56c52f9727c4f522d14ee5b
-
Filesize
614B
MD568f56109038769634bbb5e0436824738
SHA19a964f186be18c5afa46d4ea52fc77d93dcd668b
SHA256307a94103cb4c3a50e55aed5747fe3e4fa2a9157fba375f2a39ceafa415823b4
SHA51228589767c83993a123d43c6179d3c647de3d96995ef49f71f48fcdbe964b735f0911fd9ceaf7a0e446220675c907fa92ba53b4bad8bcb4851ebbb3ea3ab41cbb
-
Filesize
60KB
MD570097e33cd20e2f09bb60635233eeba6
SHA1fa4657369b36eb8e97237485688f729edba8d156
SHA25671497654e4c373766fba52e1aa4f087a4bcf0c6ca02c67273cc12459a238248c
SHA51292000141d26ead9a011b4c7a702c7c44c4a6705e4f38ae60068bdb9ea03e966a7ff22bce4e9df73eb2b2e0111d84c5c3e39d68a78e3d39735093170ea0a745f2
-
Filesize
59KB
MD5ae94cf26d3cf1ddfec5acd7270045e54
SHA1575f7b9eedba31fc3dacca8444ae091d369c968e
SHA2565ae541ab2e90eef03ecc84522a6af155985ecb961382e1b81f6238f22ec4472b
SHA512f69ee24775e8e048b80705c7432c11e6f1a6041bad4747a033e48fce3472d8c72d3b0b049316eaba4a8cf14ec840e8e1a65fddcd4f038347996262e48ccc5c27
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47