Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 00:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe
-
Size
134KB
-
MD5
5e50674fc2ca3eff46bed2e9cc3a11e1
-
SHA1
1c8252cdd0a204cbeb5534c0a3b6dd82716895af
-
SHA256
163aed40fd6bd0f885f3d6201583bdc062044792d2b0ea8c0757ce00a6d4f0e2
-
SHA512
7e2f769583eb45cf16ae41fa61280de2f798594f2710d524b8de047b7445f2c00a1d7bfd81b55e9d9e931cf984cfe8d6ad1d80bf73239ca08a92eba1d81f25ca
-
SSDEEP
1536:jSqyQc5gsfh84Xpuu0rDhaltXkXo8UTaSzrbuip5hVNlwmWhyE1yoQgSE:MtRy4srDEioFaSiip5hVrwXTvS
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation 5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 3 IoCs
pid Process 1156 DocumentsSERVER.EXE 4468 svchost.exe 4552 DocumentsSERVER.EXE -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Proactive Windows Security Explorer = "C:\\Windows\\svchost.exe" 5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Proactive Windows Security Explorer = "C:\\Windows\\svchost.exe" svchost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\A: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\Z: svchost.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf svchost.exe File created C:\autorun.inf svchost.exe File opened for modification C:\autorun.inf svchost.exe File created F:\autorun.inf svchost.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\morpheus\my shared folder\My Photo.JPG.exe svchost.exe File created C:\Program Files (x86)\tesla\files\Windows Activision.exe svchost.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\Game.com svchost.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\My Photo.JPG.exe svchost.exe File created C:\Program Files (x86)\limewire\shared\Keygen.exe svchost.exe File created C:\Program Files (x86)\icq\shared folder\Serial.txt.exe svchost.exe File created C:\Program Files (x86)\limewire\shared\Serial.txt.exe svchost.exe File created C:\Program Files (x86)\grokster\my grokster\Keygen.exe svchost.exe File created C:\Program Files (x86)\kazaa\my shared folder\Keygen.exe svchost.exe File created C:\Program Files (x86)\limewire\shared\My Photo.JPG.exe svchost.exe File created C:\Program Files (x86)\winmx\shared\Game.com svchost.exe File created C:\Program Files (x86)\bearshare\shared\Crack.exe svchost.exe File created C:\Program Files (x86)\emule\incoming\Keygen.exe svchost.exe File created C:\Program Files (x86)\winmx\shared\Windows Activision.exe svchost.exe File created C:\Program Files (x86)\bearshare\shared\My Photo.JPG.exe svchost.exe File created C:\Program Files (x86)\kazaa\my shared folder\Serial.txt.exe svchost.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\Crack.exe svchost.exe File created C:\Program Files (x86)\tesla\files\Crack.exe svchost.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\Keygen.exe svchost.exe File created C:\Program Files (x86)\emule\incoming\Windows Activision.exe svchost.exe File created C:\Program Files (x86)\grokster\my grokster\Windows Activision.exe svchost.exe File created C:\Program Files (x86)\kazaa\my shared folder\Game.com svchost.exe File created C:\Program Files (x86)\edonkey2000\incoming\Keygen.exe svchost.exe File created C:\Program Files (x86)\icq\shared folder\Keygen.exe svchost.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\Serial.txt.exe svchost.exe File created C:\Program Files (x86)\winmx\shared\Serial.txt.exe svchost.exe File created C:\Program Files (x86)\emule\incoming\My Photo.JPG.exe svchost.exe File created C:\Program Files (x86)\edonkey2000\incoming\Game.com svchost.exe File created C:\Program Files (x86)\grokster\my grokster\Crack.exe svchost.exe File created C:\Program Files (x86)\morpheus\my shared folder\Keygen.exe svchost.exe File created C:\Program Files (x86)\emule\incoming\Crack.exe svchost.exe File created C:\Program Files (x86)\grokster\my grokster\Serial.txt.exe svchost.exe File created C:\Program Files (x86)\bearshare\shared\Game.com svchost.exe File created C:\Program Files (x86)\grokster\my grokster\Game.com svchost.exe File created C:\Program Files (x86)\morpheus\my shared folder\Game.com svchost.exe File created C:\Program Files (x86)\icq\shared folder\Windows Activision.exe svchost.exe File created C:\Program Files (x86)\emule\incoming\Game.com svchost.exe File created C:\Program Files (x86)\winmx\shared\My Photo.JPG.exe svchost.exe File created C:\Program Files (x86)\kazaa\my shared folder\Crack.exe svchost.exe File created C:\Program Files (x86)\emule\incoming\Serial.txt.exe svchost.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\Serial.txt.exe svchost.exe File created C:\Program Files (x86)\bearshare\shared\Windows Activision.exe svchost.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\Game.com svchost.exe File created C:\Program Files (x86)\edonkey2000\incoming\Crack.exe svchost.exe File created C:\Program Files (x86)\limewire\shared\Crack.exe svchost.exe File created C:\Program Files (x86)\morpheus\my shared folder\Crack.exe svchost.exe File created C:\Program Files (x86)\tesla\files\Keygen.exe svchost.exe File created C:\Program Files (x86)\morpheus\my shared folder\Serial.txt.exe svchost.exe File created C:\Program Files (x86)\kazaa\my shared folder\My Photo.JPG.exe svchost.exe File created C:\Program Files (x86)\kazaa\my shared folder\Windows Activision.exe svchost.exe File created C:\Program Files (x86)\limewire\shared\Game.com svchost.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\Crack.exe svchost.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\My Photo.JPG.exe svchost.exe File created C:\Program Files (x86)\tesla\files\My Photo.JPG.exe svchost.exe File created C:\Program Files (x86)\icq\shared folder\Crack.exe svchost.exe File created C:\Program Files (x86)\winmx\shared\Crack.exe svchost.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\Keygen.exe svchost.exe File created C:\Program Files (x86)\winmx\shared\Keygen.exe svchost.exe File created C:\Program Files (x86)\bearshare\shared\Serial.txt.exe svchost.exe File created C:\Program Files (x86)\edonkey2000\incoming\Windows Activision.exe svchost.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\Windows Activision.exe svchost.exe File created C:\Program Files (x86)\morpheus\my shared folder\Windows Activision.exe svchost.exe File created C:\Program Files (x86)\grokster\my grokster\My Photo.JPG.exe svchost.exe File created C:\Program Files (x86)\icq\shared folder\My Photo.JPG.exe svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svchost.exe 5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe File opened for modification C:\Windows\svchost.exe 5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 5004 1156 WerFault.exe 87 1908 4552 WerFault.exe 95 -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings 5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3044 OpenWith.exe 228 OpenWith.exe 552 OpenWith.exe 3708 OpenWith.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4808 wrote to memory of 1156 4808 5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe 87 PID 4808 wrote to memory of 1156 4808 5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe 87 PID 4808 wrote to memory of 1156 4808 5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe 87 PID 4808 wrote to memory of 4468 4808 5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe 92 PID 4808 wrote to memory of 4468 4808 5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe 92 PID 4808 wrote to memory of 4468 4808 5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe 92 PID 4468 wrote to memory of 4552 4468 svchost.exe 95 PID 4468 wrote to memory of 4552 4468 svchost.exe 95 PID 4468 wrote to memory of 4552 4468 svchost.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5e50674fc2ca3eff46bed2e9cc3a11e1_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\DocumentsSERVER.EXE"C:\Users\Admin\DocumentsSERVER.EXE"2⤵
- Executes dropped EXE
PID:1156 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 2723⤵
- Program crash
PID:5004
-
-
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\DocumentsSERVER.EXE"C:\Users\Admin\DocumentsSERVER.EXE"3⤵
- Executes dropped EXE
PID:4552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 2284⤵
- Program crash
PID:1908
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3044
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1156 -ip 11561⤵PID:5028
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4552 -ip 45521⤵PID:4080
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD5cc06342cb0ace7abe917191cf4d52689
SHA10b762d77d20896f7721c3592477e6ddbb7b3fa70
SHA256deaa10e000c4d758c5cb8e476c3122c0e904c46cfcb50819454e44ed8de8991e
SHA512b943f7fe58bc333dd1ababdfea63de0420176e4727d15fac631cf045f6146fb73f2f68e7c6ed446becd25ebe7a353f284e13fdcace11db2d675595d445e7287a
-
Filesize
33KB
MD56500980b9874022352f7a11c3b45ea4c
SHA11ff410ae32eed7af834f11c9901a03bdbafe93b2
SHA256daecb4df367c14fd5ed31dd5db8aa33c3969ca9e4af6fe4da1826e2a8864ef02
SHA512432fad3e75c1a01033d8e311cc4d275c5a041cb7350d1f5fd28c4a8240b290b089ef377f117f9aa1979515db001c161ab76c389c0be7fe7ce381e80945e48a59
-
Filesize
39B
MD567235f540ada2c2e6832c1debb5d536c
SHA1e5f70c2074623a863b2dc3ef9cd83642d7a2ab6a
SHA25629bd5b90368a01a560a525c156ee07580cd4642e1f71728d04437fa52982d1cd
SHA512e5aab95437ca53a294eb10aa901b3be6683552b0365ff20ffbd1faa325095aea59e5c92d2c8b8a1a3558f2eb13dcb9d6fbf448d962de25d374d89b191d9faeea
-
Filesize
134KB
MD55e50674fc2ca3eff46bed2e9cc3a11e1
SHA11c8252cdd0a204cbeb5534c0a3b6dd82716895af
SHA256163aed40fd6bd0f885f3d6201583bdc062044792d2b0ea8c0757ce00a6d4f0e2
SHA5127e2f769583eb45cf16ae41fa61280de2f798594f2710d524b8de047b7445f2c00a1d7bfd81b55e9d9e931cf984cfe8d6ad1d80bf73239ca08a92eba1d81f25ca