Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 08:34
Static task
static1
Behavioral task
behavioral1
Sample
451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
451036dfa1fc0e15964fe6292f1e03ae
-
SHA1
1ca90e2ab12d2bca1cf09277af60cfb3b9da88c8
-
SHA256
6227073ec7fd458d7765e59f55dbb20946b0ddf7d50180f7e2853daeb8c36a26
-
SHA512
7bb3ab37e1e245db49a0cf5529c81e2048ad901a41850a0f075b3ad8ca236cd5f72861a90825ee9ae2069216f192ddfd8c294d36495050e995ebc1fa82e0f143
-
SSDEEP
24576:3t+PGXJIYJgv8E32bpXnKKLA3FEQTdHUOD0/WkdmKaMaOhhKJ:dJXJQ32l3tLtIHXAOkdmn
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\command 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Topic\ = "Connect" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Topic\ = "Connect" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cha 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe\" -noconnect" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\URL Protocol 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe\" -noconnect" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Application\ = "mIRC" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cha\ = "ChatFile" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\ = "%1" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\ = "URL:IRC Protocol" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe\"" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Topic 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\irc\DefaultIcon 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\ifexec\ = "%1" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.chat\ = "ChatFile" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Application 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ifexec\ = "%1" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\EditFlags = 02000000 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe\"" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\irc 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\ = "Chat File" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec\Topic 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ifexec 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec\ifexec 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.chat 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Application\ = "mIRC" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\irc 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\command 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\DefaultIcon 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\irc\Shell\open\command 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec\Application 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ = "%1" 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2496 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe 2496 451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
915B
MD563a8ac4a048b63b558f816c1d690065f
SHA14792709596955c8077d56f18daff771b528e2faf
SHA2567a69cef7a4af2649fc80b10fb9ca6c1ff0a9a76fea7127ef0ff11571d863a162
SHA5128ed3628e1f37ed930d75f85a45d213a2209e36a7f8df44a784539acdc49d9d9898b7f109bc59cdb6bb7b8bf05abae90d667b1942c582e68c1fe4641932654197
-
Filesize
875B
MD5a7afc3ee8eb79b3ec537d557067aaa5a
SHA15dc296dab63520e831345311aa0d765c41bbe10f
SHA25648143eadea47adac233d8d1eb536f9992eb04ee2a5f3efc66798279931191df8
SHA5121083a7af3b67fb8fafae1fa10ae80d799cf3c016ede54938add4520e4c45d472b999764e18616f62e3ddf1bcb9b285328c307f841a33aa7fcc3f8fe3b4da9559