Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
631a885ec946d053898995473d167c65_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
631a885ec946d053898995473d167c65_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
631a885ec946d053898995473d167c65_JaffaCakes118.exe
-
Size
76KB
-
MD5
631a885ec946d053898995473d167c65
-
SHA1
1095fe555c923f704f26ad230ef47b78bdf0069d
-
SHA256
a7958ff408bd0595afb223af996a37bd5746e71f16f7d4891863b92680b7c231
-
SHA512
f34e4765c2d0aee593c77dae9c942625e9b00b303cac2a8d73c9113d026f9c89c0729876e8df15f6d867b650c1c6790d718d9892a7743bee66e5acbf959a66bd
-
SSDEEP
1536:MtbF2XPQobZrMEcXLilRcr9jFPIgbFJ1vxyB0BepjVrs2ryrd1vUQuq6:MtYXlbZg97AIh5Tb7Nu0BeHs2qo
Malware Config
Signatures
-
Drops file in Program Files directory 16 IoCs
description ioc Process File opened for modification C:\Program Files\EnableSwitch.mhtml 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\chllsvtv.exe 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\hcjzqenb.exe 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM 631a885ec946d053898995473d167c65_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe 631a885ec946d053898995473d167c65_JaffaCakes118.exe -
Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32 631a885ec946d053898995473d167c65_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe" 631a885ec946d053898995473d167c65_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3} 631a885ec946d053898995473d167c65_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe" 631a885ec946d053898995473d167c65_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe" 631a885ec946d053898995473d167c65_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "zrbetlesxqzjenhk" 631a885ec946d053898995473d167c65_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32 631a885ec946d053898995473d167c65_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe" 631a885ec946d053898995473d167c65_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A28D5790-AE99-3E4B-975A-E96492989A07} 631a885ec946d053898995473d167c65_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32 631a885ec946d053898995473d167c65_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509} 631a885ec946d053898995473d167c65_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "wrzjsebktrbszqeb" 631a885ec946d053898995473d167c65_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD} 631a885ec946d053898995473d167c65_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "nxrvwlhsrstcnsbc" 631a885ec946d053898995473d167c65_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "keewtrbhbzenlvnc" 631a885ec946d053898995473d167c65_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564} 631a885ec946d053898995473d167c65_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A28D5790-AE99-3E4B-975A-E96492989A07}\ = "hzqlhkbjesztzzvz" 631a885ec946d053898995473d167c65_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A28D5790-AE99-3E4B-975A-E96492989A07}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\631a885ec946d053898995473d167c65_JaffaCakes118.exe" 631a885ec946d053898995473d167c65_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe" 631a885ec946d053898995473d167c65_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32 631a885ec946d053898995473d167c65_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892} 631a885ec946d053898995473d167c65_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "knhkwrlnckeehvrt" 631a885ec946d053898995473d167c65_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A28D5790-AE99-3E4B-975A-E96492989A07}\LocalServer32 631a885ec946d053898995473d167c65_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32 631a885ec946d053898995473d167c65_JaffaCakes118.exe