Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 02:22
Behavioral task
behavioral1
Sample
3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe
-
Size
415KB
-
MD5
3ba64a359b74ac8153763b5562f34a4f
-
SHA1
abdd04c17f9edaab63ccddab16160f446e24bbb1
-
SHA256
38cb941ec11b3742682daa12bf34c8ce671e444870af87fa400e16f606b0952d
-
SHA512
767e540bbb25cee2504e75c91f5c34cc647ee7783f6669aab76804a5f0a615f55b18e09682b11f2898a493be481a26489188d3342b58d5ede1baf613377f64fe
-
SSDEEP
12288:qv6ap4FpYvkOAmu02KbGqW63sYB12uoU:pap4nWF/9RbGAsYB1CU
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\adp94xx.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\evbda.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\sffp_mmc.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\DRIVERS\pacer.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\drmkaud.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\hidbth.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\parport.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\processr.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\scfilter.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\DRIVERS\lltdio.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\amdide.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\DRIVERS\ipfltdrv.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\IPMIDrv.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\qwavedrv.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\TsUsbGD.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\viaide.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\discache.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\aliide.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\dxgkrnl.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\lsi_sas2.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\mpio.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\tcpipreg.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\hcw85cir.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\DRIVERS\ndiscap.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\ql40xx.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\rdpencdd.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\storvsc.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\wacompen.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\pcmcia.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\wmiacpi.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\agp440.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\BrFiltUp.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\Brserid.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\MSKSSRV.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\cmdide.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\sbp2port.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\stexstor.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\ql2300.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\iaStorV.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\isapnp.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\lsi_scsi.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\nvstor.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\USBSTOR.SYS 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\arc.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\circlass.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\DRIVERS\nwifi.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\synth3dvsc.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\terminpt.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\uliagpkx.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\vmbus.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\DRIVERS\rspndr.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\amdk8.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\BrUsbMdm.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\RDPWD.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\sfloppy.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\mpsdrv.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\nvraid.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\wd.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\netbt.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rdpvideominiport.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\sermouse.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\usbcir.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rdvgkmd.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\1394ohci.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2732-2-0x0000000000400000-0x00000000004B4000-memory.dmp vmprotect behavioral1/memory/2732-0-0x0000000000400000-0x00000000004B4000-memory.dmp vmprotect behavioral1/memory/2732-8-0x0000000000400000-0x00000000004B4000-memory.dmp vmprotect -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2732 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe 2732 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2732