Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 00:59
Static task
static1
Behavioral task
behavioral1
Sample
6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
6585f4bb6affc9cbafd941e260322759
-
SHA1
039773d81b787cd56eaf831503330f21299d1f6f
-
SHA256
b21adf64f103e94fb0150da6efe567af547c7ca48a1c09aaa99bad7f8d33fbad
-
SHA512
3a096ba666bc2b15d86881c2ee877b4843f734062c5534ad660db662b2b453d08744daeb7e3e7f982e2f52dbc9a87e118ffa3d16be8b1b0a0c14fb317031f11d
-
SSDEEP
49152:If7xgiTYZbruT5Koqf8Dm98YJiJcyWnMlo:gY3uVxT1Y0JzWM+
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2260 Protector-cqwr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 48 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0\0\win64\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\VersionIndependentProgID\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\ = "Ezaqoxa Object" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\Implemented Categories 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0\ = "Microsoft ActiveX Data Objects 6.0 Library" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0\0\win64 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1\0 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\TypeLib\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0\FLAGS 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1\ = "Microsoft ActiveX Data Objects 6.1 Library" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1\0\win32 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\ProgID 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\ProgID\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\ProgID\ = "WScript.Shell.1" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0\0\win32\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1\0\win32\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1\0\win64 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1\0\win64\ = "C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1\FLAGS\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\TypeLib\ = "{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\Programmable\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1\0\win32\ = "C:\\Program Files (x86)\\Common Files\\System\\ado\\msado15.dll" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1\0\win64\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0\FLAGS\ = "0" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\TypeLib 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\VersionIndependentProgID\ = "WScript.Shell" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E} 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\Implemented Categories\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\InProcServer32\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\Programmable 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0\FLAGS\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0\0 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0\0\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1\FLAGS\ = "0" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E} 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0\0\win32 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1\0\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.1\FLAGS 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\InProcServer32 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\InProcServer32\ = "C:\\Windows\\SysWOW64\\wshom.ocx" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0\0\win32\ = "C:\\Program Files (x86)\\Common Files\\System\\ado\\msado60.tlb" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1F7F95B-31D1-2E6E-C32B-D5110B1CD45E}\6.0\0\win64\ = "C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DBDD8A-B221-400E-C4AB-C39E5A0E9B0E}\VersionIndependentProgID 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 616 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Token: SeShutdownPrivilege 616 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Token: SeDebugPrivilege 2260 Protector-cqwr.exe Token: SeShutdownPrivilege 2260 Protector-cqwr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 616 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 2260 Protector-cqwr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 616 wrote to memory of 2260 616 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 87 PID 616 wrote to memory of 2260 616 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 87 PID 616 wrote to memory of 2260 616 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 87 PID 616 wrote to memory of 2668 616 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 88 PID 616 wrote to memory of 2668 616 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 88 PID 616 wrote to memory of 2668 616 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Roaming\Protector-cqwr.exeC:\Users\Admin\AppData\Roaming\Protector-cqwr.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2260
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\6585F4~1.EXE" >> NUL2⤵PID:2668
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD56585f4bb6affc9cbafd941e260322759
SHA1039773d81b787cd56eaf831503330f21299d1f6f
SHA256b21adf64f103e94fb0150da6efe567af547c7ca48a1c09aaa99bad7f8d33fbad
SHA5123a096ba666bc2b15d86881c2ee877b4843f734062c5534ad660db662b2b453d08744daeb7e3e7f982e2f52dbc9a87e118ffa3d16be8b1b0a0c14fb317031f11d