Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3a03aa138f7...18.exe
windows7-x64
7a03aa138f7...18.exe
windows10-2004-x64
7$PLUGINSDI...am.dll
windows7-x64
3$PLUGINSDI...am.dll
windows10-2004-x64
3$PLUGINSDI...ew.dll
windows7-x64
3$PLUGINSDI...ew.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ta.dll
windows7-x64
3$PLUGINSDI...ta.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...sg.dll
windows7-x64
3$PLUGINSDI...sg.dll
windows10-2004-x64
3$PLUGINSDI...te.dll
windows7-x64
3$PLUGINSDI...te.dll
windows10-2004-x64
3$PLUGINSDI...gr.dll
windows7-x64
3$PLUGINSDI...gr.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...nd.dll
windows7-x64
3$PLUGINSDI...nd.dll
windows10-2004-x64
3$PLUGINSDIR/stack.dll
windows7-x64
3$PLUGINSDIR/stack.dll
windows10-2004-x64
3$PLUGINSDIR/xml.dll
windows7-x64
3$PLUGINSDIR/xml.dll
windows10-2004-x64
3RVAutoUpdate.exe
windows7-x64
3RVAutoUpdate.exe
windows10-2004-x64
3RVEngine.dll
windows7-x64
3RVEngine.dll
windows10-2004-x64
3Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2024, 22:43
Static task
static1
Behavioral task
behavioral1
Sample
a03aa138f79d620d2807c63a7887fd86_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a03aa138f79d620d2807c63a7887fd86_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/DLLWebCount_new.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/DLLWebCount_new.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/IEFunctions.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/IEFunctions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/IsVista.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/IsVista.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/RealVaccineMsg.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/RealVaccineMsg.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/SelfDelete.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/SelfDelete.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/UserMgr.dll
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/UserMgr.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/processes_second.dll
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/processes_second.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/stack.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/stack.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/xml.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/xml.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
RVAutoUpdate.exe
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
RVAutoUpdate.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
RVEngine.dll
Resource
win7-20240729-en
Behavioral task
behavioral32
Sample
RVEngine.dll
Resource
win10v2004-20240802-en
General
-
Target
a03aa138f79d620d2807c63a7887fd86_JaffaCakes118.exe
-
Size
4.1MB
-
MD5
a03aa138f79d620d2807c63a7887fd86
-
SHA1
fae92133307c71dad66812f5c5e7a1f8ac7144d2
-
SHA256
2fbba20ba941effe437069acdb339e0bd2495fa2eebed787815840cb63a4c9e2
-
SHA512
861e64aa61780287369e34bd89984f649a3c5f8e2333ff5ae8b1ae39f92335e18847967a436d9d90280451e2dbfde2268077848fda6ae2fb5fa4376f1db32c02
-
SSDEEP
98304:ZyuJW9Spr6F7ccZNeRQRIEmJji0b4gvwqh9nM9kSwXL6iZBVIB:Zyu8SpeFQcrei0b4+wqh1lSj6Y
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 2680 a03aa138f79d620d2807c63a7887fd86_JaffaCakes118.exe 2680 a03aa138f79d620d2807c63a7887fd86_JaffaCakes118.exe 2680 a03aa138f79d620d2807c63a7887fd86_JaffaCakes118.exe 2680 a03aa138f79d620d2807c63a7887fd86_JaffaCakes118.exe 2680 a03aa138f79d620d2807c63a7887fd86_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a03aa138f79d620d2807c63a7887fd86_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5eef9e469e8a30717974499f277d97e2a
SHA12d33c25984ebd9116beeb55cdde4c5c86c023e5d
SHA2561f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078
SHA512d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48
-
Filesize
44KB
MD5344d13fd0fdd2d97e8d61960f40a8a30
SHA13f0f120203005eea3e8ed1652a6ea8a607ea934d
SHA25617bb3331e2300aa01666fbee98b9552cec5e46212a4c5a340c0370b93df88f83
SHA512b4e49c58503532e270cc369f1cbd14d85edd46da5ab034dad730bd4297887dd541d445d2fbf205820e6afbbdba7ab6d5b78b694467554320fd6db8e06fe4f719
-
Filesize
388B
MD549a4f52633e24774c27f5f5b561c4436
SHA101f28c723ddfd12cd6fdaae0df76295d1e243855
SHA256e7baf82a5fb377321c65d0ca45f79351e1ee27c0b59b69dd77670df38e9c6725
SHA512a3072c33a5ace10d879da83226c3c32c1292b65b51b824ac8120a7c802a131b015d6e216c26931aad1e56580ebc3486013567d9139eee7a8422063715080e36f
-
Filesize
687B
MD5eb2e512f5ee0db725e9f3da0a14f4f44
SHA172e9c23764bfc74d837d36f6b7d8a5e275d0657c
SHA256d90130cbce1165a01ea0f31e18fdeabd2eb91b2307e3b8053f77dc8e26b60006
SHA5122811448f92db3a7722ddf4641913a058b95fa56c3b89590d996cfbc539b5ed82670d4f75978beeadc0133b8cbdd3957d534191cdb7eeb867de76bfa849e5b878
-
Filesize
10KB
MD50f61a81a543822de5fcb9a8a43f230dd
SHA1d01d4a0f542f3c654637fdfe5a574fe1f150ece1
SHA25646b4a72ae8590b0afb3304cc5c13db0502bc4c4cb02f64f37c79008c17db814f
SHA512596b7a897ba64c32e26ba6168aa3628aad37b187a9814a286298307d8c42eabf8e8a679dbda558f8b2cdc8676c94ec819256432aa5ad7c05a5387759262a4402