Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe
-
Size
88KB
-
MD5
5c6cc61b12bc997b3ad44dc3e7e48869
-
SHA1
fc7a56e3a007f9d2bc6e66a799d37568531e4df9
-
SHA256
7e1e5846a07f31e9686f153ee178fab64d935fbdeb3fdffb0fca1204a6fbdb11
-
SHA512
26d22c3372cc071d92c19f4cec31c0ebda8f761b71639271b8d4b3cc54de1d0a5f454f03ef946b07a21e818d956584622930c21dfba2cff85f6732d16f7b792a
-
SSDEEP
1536:XtZHJGPKZi+unw3uzV1cnf+7YT3CiippoNr9hTcOujjwGTr0aIiksSaV1K7ZN+:d3GCZi+u93427uCuNr9hoOVGToadTutQ
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll" 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe -
Loads dropped DLL 36 IoCs
pid Process 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 3048 svchost.exe 3048 svchost.exe 3048 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 3224 svchost.exe 3224 svchost.exe 3224 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 2920 svchost.exe 2920 svchost.exe 2920 svchost.exe 4112 svchost.exe 4112 svchost.exe 4112 svchost.exe 4600 svchost.exe 4600 svchost.exe 4600 svchost.exe 640 svchost.exe 640 svchost.exe 640 svchost.exe 1244 svchost.exe 1244 svchost.exe 1244 svchost.exe 2148 svchost.exe 2148 svchost.exe 2148 svchost.exe -
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Nla.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\NWCWorkstation.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Wmi.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Ias.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Irmon.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SRService.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\LogonHours.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\PCAudit.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\helpsvc.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\uploadmgr.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Ntmssvc.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WmdmPmSp.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Nwsapagent.dll 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3632 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe 3632 5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5c6cc61b12bc997b3ad44dc3e7e48869_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3632
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
PID:3544
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon1⤵
- Loads dropped DLL
PID:1144
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla1⤵
- Loads dropped DLL
PID:3048
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc1⤵
- Loads dropped DLL
PID:1512
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation1⤵
- Loads dropped DLL
PID:3224
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent1⤵
- Loads dropped DLL
PID:684
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService1⤵
- Loads dropped DLL
PID:2920
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp1⤵
- Loads dropped DLL
PID:4112
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours1⤵
- Loads dropped DLL
PID:4600
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit1⤵
- Loads dropped DLL
PID:640
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc1⤵
- Loads dropped DLL
PID:1244
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr1⤵
- Loads dropped DLL
PID:2148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD59c014d1c54457c16c99782df12610b85
SHA16bac6ad9d8f375ccca6cb349e88dcdd90f16e13d
SHA2566b51809245383365496c333e3dddda94887d66fe39f7510fe8f40c56c96dd82a
SHA5124115e2ea25356e0a23de2a9382ca7bcce2696108eca4d32c52a8bd52f0ce0ab9693c6a05c2916414c546ea5b89bf090da78f48fe41be5531e3897f3dfe9c87a3