Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 02:22
Behavioral task
behavioral1
Sample
3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe
-
Size
415KB
-
MD5
3ba64a359b74ac8153763b5562f34a4f
-
SHA1
abdd04c17f9edaab63ccddab16160f446e24bbb1
-
SHA256
38cb941ec11b3742682daa12bf34c8ce671e444870af87fa400e16f606b0952d
-
SHA512
767e540bbb25cee2504e75c91f5c34cc647ee7783f6669aab76804a5f0a615f55b18e09682b11f2898a493be481a26489188d3342b58d5ede1baf613377f64fe
-
SSDEEP
12288:qv6ap4FpYvkOAmu02KbGqW63sYB12uoU:pap4nWF/9RbGAsYB1CU
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\hidi2c.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\DRIVERS\ramdisk.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\AgileVpn.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\storvsc.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\ufx01000.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\acpitime.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_GPIO2_GLK.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\ipt.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_I2C.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\MsRPC.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\xinputhid.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\3ware.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\msgpioclx.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSSi_I2C.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\sdstor.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\vsmraid.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\lsi_sas3i.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\megasas35i.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\megasr.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\udecx.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\USBXHCI.SYS 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\winmad.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\CAD.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_I2C_GLK.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\lsi_sas.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\Microsoft.Bluetooth.AvrcpTransport.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\terminpt.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\vmgid.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\pnpmem.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\scfilter.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdi2c.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\mvumis.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\TsUsbGD.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\WudfPf.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\hidir.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\ipnat.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\ndfltr.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\pciide.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\ucx01000.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\winnat.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\asyncmac.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\HyperVideo.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\raspppoe.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\mlx4_bus.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\SpatialGraphFilter.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\ndiswan.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rasl2tp.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdxata.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\HpSAMD.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdsata.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\system32\DRIVERS\ipfltdrv.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\MSPQM.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\MSTEE.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\nvstor.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\sdbus.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\UcmTcpciCx.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaStorAVC.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\lsi_sss.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\UsbHub3.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\WinUSB.SYS 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\usbprint.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\xboxgip.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\BTHMINI.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\EhStorTcgDrv.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/1740-0-0x0000000000400000-0x00000000004B4000-memory.dmp vmprotect behavioral2/memory/1740-1-0x0000000000400000-0x00000000004B4000-memory.dmp vmprotect behavioral2/memory/1740-5-0x0000000000400000-0x00000000004B4000-memory.dmp vmprotect -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\genericusbfn.inf_amd64_53931f0ae21d6d2c\genericusbfn.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\UEFI.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ufxchipidea.inf_amd64_1c78775fffab6a0a\UfxChipidea.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\urschipidea.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\urssynopsys.sys 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1740 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe 1740 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1740