Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3a5357b0164...18.exe
windows7-x64
7a5357b0164...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Jigsaw.dll
windows7-x64
1Jigsaw.dll
windows10-2004-x64
1JigsawBeac...ay.exe
windows7-x64
3JigsawBeac...ay.exe
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3aminstall.dll
windows7-x64
3aminstall.dll
windows10-2004-x64
3Analysis
-
max time kernel
134s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 03:27
Static task
static1
Behavioral task
behavioral1
Sample
a5357b01647400c898692509e56e70e0_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a5357b01647400c898692509e56e70e0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Jigsaw.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
Jigsaw.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
JigsawBeachHoliday.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
JigsawBeachHoliday.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Uninstall.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
aminstall.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
aminstall.dll
Resource
win10v2004-20240802-en
General
-
Target
a5357b01647400c898692509e56e70e0_JaffaCakes118.exe
-
Size
5.6MB
-
MD5
a5357b01647400c898692509e56e70e0
-
SHA1
c1ae3aad7341eed321a8e8880e6853339355f013
-
SHA256
45b5b444fb9c51207474a3d3baa9062056ce5f44d4f092930fc68e06da6f8faa
-
SHA512
61ce28a65e42ac63a481e5c33ae30f647ff44a73baeb7aa1d71322f6bbcb6c53578fa7bea209fb67b379dc9a3a0ad10987137e8362a3943f7721bb37c90caf23
-
SSDEEP
98304:xSkZo0qPks6qC+a26DWmgenA2y/LfhNeNmyEH3f8rRZG6Y1vSkIsQlN:4M6fTCD26D1nH+NN4zEXb1jZQ3
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 3040 a5357b01647400c898692509e56e70e0_JaffaCakes118.exe 3040 a5357b01647400c898692509e56e70e0_JaffaCakes118.exe 3040 a5357b01647400c898692509e56e70e0_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5357b01647400c898692509e56e70e0_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD529459d9ee2bce32ed937fb1f965f9d5e
SHA18fff45ed45f3af8f8c248eba9a1c02c9c5fc911d
SHA256ad07968b7d93ef19e10e1deb52e0c912e96dde30c0a49a0239daf176fd4c9ef5
SHA512d4ef4eadb0f53e7086a1d242bf7f745ad79d83d9ecbfaa283cf0dd499271a804589a575040bb20d5c98e86197cc65ca05ab1a358c556ea82a3e297d0255015a6
-
Filesize
10KB
MD505e52213cfa17dee760186462a9645ed
SHA1f6d5e82080bbba65db7d54e89250c95af833aae3
SHA256d9d3ffa4c7d7a152f435f4777e72aa1b6a6c0555f277e59eedebc587c3b66ba5
SHA512586eea0bec6345b437667ce528bc2396427dd444a396456e38046a8962e92a52e7ee62b9f6c97f41bc1fb4a1b3905a302d6f7055e26b84e60709ba3b416ad172
-
Filesize
692B
MD5d9a30e9a10377ceb5c9e13c0f587df14
SHA1905c91185b3e2c9798f2db8f22e02744028276b1
SHA2569682047c0232dd630d62330627b2621bd2a51790de595693b182f14a942bc06c
SHA512c505730e1c3df7f9b8cce899ab5cea5ad3c75e8262bbde89ac83fa4a161c91a95440fa47c6c6da10b2312649aa8785c4bda2ad5c6f6ac01e84d0af520c3a0c51
-
Filesize
718B
MD5e437e44a4259f4a39f2e7f454e1f1c7d
SHA11d60cae31957eda37d63db3dc9edc19491265872
SHA2567b74ad64e44e241c4d39e2a0d0dc29688eff1d19840f1c760bac7175b98cf654
SHA512917c49f136dbaa79dc8b3d3498e8c0534f0b5a462df161f82e5ca6ebfd8e9b3fedaf637d21664e15dcc9db5227692fd161a3342bd00b3db6639b61654db685cf