Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 20:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe
-
Size
777KB
-
MD5
3ed8cfa423f03b247848b200d533210b
-
SHA1
25e785aa65dde528f7d838871bc9776958170c82
-
SHA256
f46129dfb27fe10ee0202684416ff4426243a8fb7f7a2b2055e58205aafb28bf
-
SHA512
fdaed4bb7bcae071288b59699944d765285c8931c87a64a559e56082207073e5e6cdcbb7b3c6e073909e10a83112dd42f0f515a8724168ca86de45d32deab656
-
SSDEEP
24576:baEqn4on6JnmHFBiogPHobg0Dy6qlL5M5uZZ/jrQ:onnn6JkrgPYgdM5+ljs
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 2776 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe 2776 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe 2776 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe 2776 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe 2776 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe -
Drops file in Program Files directory 32 IoCs
description ioc Process File created C:\Program Files (x86)\Speedj\oem.ini 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Speedj.ini 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Speedj\Speedj.ini 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Speedj\Favorite\1 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\»Æ¹ÏµçÓ°Íø£¬¸ßÇåµçÓ°.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\ÒìÐÔ½»ÓÑÍø.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\1\2144СÓÎÏ·£¬³¬¼¶ºÃÍæ.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Speedj\oem.ini 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Speedj\Favorite 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\soft252705\ppev6694.exe 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\6566ÍøÖ·´óÈ«.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\1\6566ÍøÖ·´óÈ«.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\1\¡ïÌÔ±¦Íø£¬ÌÔÎÒϲ»¶¡ï.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\1\ÀÏÆŲ»ÔÚ¼ÒÍæµÄÓÎÏ·.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\soft252705\052011050205051227052505.txt 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\soft252705\ppev6694.exe 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\dailytips.ini 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\2144СÓÎÏ·£¬³¬¼¶ºÃÍæ.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\¡ïÌÔ±¦Íø£¬ÌÔÎÒϲ»¶¡ï.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\1\»Æ¹ÏµçÓ°Íø£¬¸ßÇåµçÓ°.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\1\С˵ÔĶÁÍø.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\soft252705\setup_2505.exe 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\soft252705\setup_2505.exe 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\soft252705\gou6694.exe 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\ÀÏÆŲ»ÔÚ¼ÒÍæµÄÓÎÏ·.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\1\ÒìÐÔ½»ÓÑÍø.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\soft252705\s_2505.exe 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Speedj.exe 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\Speedj\Favorite\С˵ÔĶÁÍø.url 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File created C:\Program Files (x86)\soft252705\a 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\soft252705\s_2505.exe 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\soft252705\gou6694.exe 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{086B8F8C-4091-11EF-BE68-F2AA1BA6131E} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31118493" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31118493" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427582687" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007836378798d3c34984a02971cee2fa8c00000000020000000000106600000001000020000000c1e2b849a521e7cee4fcd21c3e2596023d40cc0bd7606c842309604554a8ace7000000000e80000000020000200000002bcb37b0f8b8b10bc0b91acd0d855624005341c2b043bc66b886e50bfbfc1e902000000073b98df5f94d42cbe491ea69c35a59bfae32a202d81edb4d946388d8ce4bb7da400000008ee1d860978097c978e92bcba87d99760f3a6f1a5bd627de79887276a23500d8e2774c25a8315da217d65c697ad06f6a3353b3dd82065aaae50e5f773bc304e8 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0eb54e69dd4da01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3704484638" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007836378798d3c34984a02971cee2fa8c000000000200000000001066000000010000200000002eedfeb184e6178e68163a8f84faaa6f8cf36cac1fda7b93a34a742c262c9413000000000e800000000200002000000013320309fcc0eb135dcd3e8f36f2c86afd91ca79b20355073d41eff6c30974ac200000001ac96541841b770d10b6964390d905f2bbc35d30cb2e8d7d16d5da214dadaeea400000000edf84f98fb5eba69725dde9ac4d8a8451be1947bf2279c21f52e3107ebdd68c128be039c2a2192e320deef00e2e02ae0e3c7ddfddeff95aba0413d263199db5 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3704484638" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31118493" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3707140886" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0bf4de69dd4da01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3384 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3384 IEXPLORE.EXE 3384 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2776 wrote to memory of 3496 2776 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe 85 PID 2776 wrote to memory of 3496 2776 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe 85 PID 2776 wrote to memory of 3496 2776 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe 85 PID 3496 wrote to memory of 3384 3496 IEXPLORE.EXE 87 PID 3496 wrote to memory of 3384 3496 IEXPLORE.EXE 87 PID 3384 wrote to memory of 2624 3384 IEXPLORE.EXE 88 PID 3384 wrote to memory of 2624 3384 IEXPLORE.EXE 88 PID 3384 wrote to memory of 2624 3384 IEXPLORE.EXE 88 PID 2776 wrote to memory of 3088 2776 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe 89 PID 2776 wrote to memory of 3088 2776 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe 89 PID 2776 wrote to memory of 3088 2776 3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3ed8cfa423f03b247848b200d533210b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" http://www.admama.cn/g/2⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.admama.cn/g/3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3384 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2624
-
-
-
-
C:\Windows\SysWOW64\Wscript.exe"C:\Windows\system32\Wscript" "C:\Program Files (x86)\soft252705\052011050205051227052505.vbe"2⤵PID:3088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5548f8a2766a9c75c9c43c5d583e80d34
SHA10259de3e8fe1e5d99bae06aa65253d1e7cc1419f
SHA256a4eee83f86d97bfe06b96c9fea3228f392bd5d1c1ea05499bfa26956dc039dcc
SHA5124324f721690ccc8ef62f2ac27a45717c0892f7747695e4800300c497c04b60dae0e3194c4ea5fafdfeb72f94665f31d97e3bf5f6c142f32d14bf3207eaa5e26d
-
Filesize
1KB
MD556298810fe619f939bd14c345d76373f
SHA1aeb0d1ae22caecf8c24a02a0259ca0e7fdca02a9
SHA256a7f9282e4c98fc7087c102bda55f573d80acd93fc7c5982a64a07feffc351d12
SHA512af67d4c0c5edb4a6a8fa88395fc78ceb7b82707aaee26e1076754227402a2121ff7923f2ec89e1c63b718b14eafaacf2150160c83960d05869ca47a0c171809f
-
Filesize
2B
MD519e9b241ae6e00c558801104fc01db53
SHA12ea6719b2bbe066f0dcff25f0809592b50b6844f
SHA2566a8fd6b98e6e602358b45ef3d81dd9fab39900137bed7c806a2fd18fd1701ec9
SHA5129a2657f731608a0b8d2f1af7dad63ab1338252e610be006dcc781b64b2ebb001712104822416d157f61955f16c6ef429dfd53e498e326b360d9d7fffe2d21abc
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7