Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 07:05
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe
-
Size
55KB
-
MD5
a5d581c6cb697a1834831b553c66c82d
-
SHA1
ead9422d5c7ac6e2640600a59408794b72586f53
-
SHA256
202322cd2a9fed4c5758209580472f3b99030c2cfde29b96b5194738f58fa0bd
-
SHA512
d18c34edb80bbb55ffa765427d76f87371a8f2cd3b16dcbe96b8b7f32572d2cc5e66b9f727ea6882252f955d1e8ba7c2b07647d6df36cdf92bb4d1ae00b52e34
-
SSDEEP
1536:0kdcgxo7hVky7G+OnrkKyrZwijQJAckqCSy4Z/SNHgmW:Hw7zxWk9Zw4QJAnqCA63W
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 58 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DisplaySwitch.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\openfiles.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\raserver.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\syskey.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\unregmp2.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gpscript.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\netbtugc.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rdrleakdiag.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\subst.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\AtBroker.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cipher.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\efsui.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\taskeng.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\logman.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sdbinst.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\taskkill.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xpsrchvw.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\diskperf.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\relog.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wimserv.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\write.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ieUnatt.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesComputerName.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mstsc.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\psr.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\setup16.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\diskraid.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\regini.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\at.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\runas.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WerFault.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\OptionalFeatures.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\regedt32.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Robocopy.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wininit.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dvdplay.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\instnm.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\net1.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\fveupdate.exe a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5d581c6cb697a1834831b553c66c82d_JaffaCakes118.exe