Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe
-
Size
124KB
-
MD5
42d70e497677df40c6d2e506db979fee
-
SHA1
c72c06b23e3a5a08b1b5d724ab17cb29a7541ea7
-
SHA256
72a705d351211e9ec40f79105cb63b1e85aa74ee41027f6b1120d606610e1986
-
SHA512
10c637bb9f0df951a744ddc36aa5c3409f61929af88fe9f7c9fd7fec19f16e639fc1dfccbf540cf44067e45c8976da94d93af9460af5e3b08152afe7e0126c0d
-
SSDEEP
1536:lLEf4wRVuBxLDtVdHa27J14lWxporZ45iMNeG0h/y:1Ef4wRVkLt6gJ1uPt45eq
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wauqaa.exe Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3696 wauqaa.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /F" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /b" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /i" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /M" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /l" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /Y" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /n" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /Q" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /C" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /T" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /L" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /j" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /h" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /A" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /x" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /k" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /v" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /K" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /t" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /c" 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /W" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /o" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /f" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /p" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /Z" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /R" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /D" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /u" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /G" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /N" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /P" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /w" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /s" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /r" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /m" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /y" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /z" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /H" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /O" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /g" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /c" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /U" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /J" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /q" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /V" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /E" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /I" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /B" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /X" wauqaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wauqaa = "C:\\Users\\Admin\\wauqaa.exe /a" wauqaa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4824 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe 4824 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe 3696 wauqaa.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4824 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe 3696 wauqaa.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4824 wrote to memory of 3696 4824 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe 86 PID 4824 wrote to memory of 3696 4824 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe 86 PID 4824 wrote to memory of 3696 4824 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\wauqaa.exe"C:\Users\Admin\wauqaa.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD54bbff7ad94ff3ab5ebad8d0eef1a3ece
SHA18e06d5f0fd5b84a335a5f8348bfa79309fee0b69
SHA2569940d579747ce8b61e85845b8f83cbc488fcf024d004114b91389db022c0018d
SHA512142fce17a4d8fe0b188a48e2a1baf623739a4fdcc52b03085054c1bd18c3553e049d2bd6ee992054366a8474f889d7d45688eaf68242724142a010804a9ac07d