Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
32e6d7f6edd...18.exe
windows7-x64
72e6d7f6edd...18.exe
windows10-2004-x64
7$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$TEMP/vidxcore.dll
windows7-x64
1$TEMP/vidxcore.dll
windows10-2004-x64
1Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 00:50
Static task
static1
Behavioral task
behavioral1
Sample
2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/DcryptDll.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/DcryptDll.dll
Resource
win10v2004-20240708-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
$TEMP/vidxcore.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$TEMP/vidxcore.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
Uninstall.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
Uninstall.exe
Resource
win10v2004-20240704-en
General
-
Target
2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe
-
Size
321KB
-
MD5
2e6d7f6edddd23b9cbcb658c0858423b
-
SHA1
e0d876179a45943dc6f5bcec68f89ad96fdfea1d
-
SHA256
6d6611463a02ae95421da86ea2be11fbeb260fddfdedb20be9561616ff33ced5
-
SHA512
44497cbb7b0c2b6bbb448b5ed4ddff8960c08156458f5e0c2b5ef84ec9b1ebad48bf0632c1860d8c0f62fd7b94ab2431dc940ae7126cc7dd981abac1df070d8a
-
SSDEEP
6144:gXUApieRR7pV97XvJH5cXlGMTVI8xulY0OqtDXj:BA0k7zZcVGWxuxOe
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 968 notepad.exe 5864 calc.exe 5892 freebsd.exe -
Loads dropped DLL 3 IoCs
pid Process 4712 2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe 4712 2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe 4712 2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 3220 5892 WerFault.exe 86 4192 968 WerFault.exe 84 3604 5864 WerFault.exe 85 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4712 wrote to memory of 968 4712 2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe 84 PID 4712 wrote to memory of 968 4712 2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe 84 PID 4712 wrote to memory of 968 4712 2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe 84 PID 4712 wrote to memory of 5864 4712 2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe 85 PID 4712 wrote to memory of 5864 4712 2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe 85 PID 4712 wrote to memory of 5864 4712 2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe 85 PID 4712 wrote to memory of 5892 4712 2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe 86 PID 4712 wrote to memory of 5892 4712 2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe 86 PID 4712 wrote to memory of 5892 4712 2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2e6d7f6edddd23b9cbcb658c0858423b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\notepad.exeC:\Users\Admin\AppData\Local\Temp\notepad.exe2⤵
- Executes dropped EXE
PID:968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 2723⤵
- Program crash
PID:4192
-
-
-
C:\Users\Admin\AppData\Local\Temp\calc.exeC:\Users\Admin\AppData\Local\Temp\calc.exe2⤵
- Executes dropped EXE
PID:5864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 2643⤵
- Program crash
PID:3604
-
-
-
C:\Users\Admin\AppData\Local\Temp\freebsd.exeC:\Users\Admin\AppData\Local\Temp\freebsd.exe2⤵
- Executes dropped EXE
PID:5892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 2643⤵
- Program crash
PID:3220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5864 -ip 58641⤵PID:3024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5892 -ip 58921⤵PID:1308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 968 -ip 9681⤵PID:5804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5d62e4ded2a8d67d1a7c8f171c5ad8b37
SHA1aa06d54927fe8c5decded29dfbebb78c72ec326c
SHA2569857032261d7400033793fd51824568e78c22226553c9dd4f628a1e90ad82a6a
SHA5123e4d4e0e09da5f4e18e9bbe07d42140f49a8f52f5c6c450c9286c9aff30804904f098b1349b20c4c4b50ba0b18e9b48289c140e491e7b569f3f3965ed2581499
-
Filesize
27KB
MD5a2b68773a9f02e87cd28fac4d1b5b07d
SHA1bef3838c5b05bb5bad99a40b8bfca85e437bf2b4
SHA256d2dcfbc6ba2b9a4e2d7ca966965a50123c6a3d2416e46105888ec62ef162658f
SHA5125073ac55e2b1abd30255d1014ff0214c448a3558a144cfcaa431fa589c2492d4de94ba20020b4f5e869be0908234a2166f9d6adff21b8e019c1c7868e34ddbfa
-
Filesize
14KB
MD5228cf7493dca4189e57d8fa20f47bb54
SHA157f5627b533012f43895551dd2c4576cb4d56a8f
SHA256a902c6d53743a696ab1d6b75d5e8c4fd4ba59370faa223224de66582663e328a
SHA5123ffff81258739161c77b5f342ff22337dbf458a1e4ee3f2c13cd2414068bb6185ae3f699e7b24c94d19b247fa8d178f54804bae6c09c192cdff35f86387062be
-
Filesize
10KB
MD569dc2ed40717e5a0dfa3feaa902f448e
SHA107a6a0b6028a92e0c822cfe9b119aa1e81b28a79
SHA25673e8489b06789803dcab0f4bcae4281f1477ec652f80714c3b78671f73cfefad
SHA512f41e457466fcc979864829861bf421ad2589ec6b5afc81d19424f7af285ce1fb7ce25cc4067e53cd379621b5b8098882210e4535a4d53555b7816edcc2186a3c