Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 12:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe
-
Size
145KB
-
MD5
aafd07250b10dba751c403ec6edad678
-
SHA1
375d4b8c47d086cdff296fc193a44368ebc4dfc9
-
SHA256
0a0907f1b2c5dc696441663a02228a824b3e095ed051607a75374d0df9f28be1
-
SHA512
07bd9a47a27040c390f3860c17337b52179ce7921308fedc365411a9dada52d92e2cf3eb824662e901c2264b83b6ec568677b9bc4ee8ce78414aff74770c4373
-
SSDEEP
3072:SF83Y+AFhR5OAw8SrHsvIDgM3ruyBIf1hOMMMMMMjMMMMMMMMMMMHMMMMMMbMMMB:aIY+ALWEM3r+hOMMMMMMjMMMMMMMMMMh
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OneDriveSetupOneDrive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe" aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftOneDriveSetup26962 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe" aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\VisualStudioMicrosoft.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\resourcesresources.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\SoftWareWMPNSSCI12.0.19041.1266.160101.0800.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\widevinecdmDecryption.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\VisualStudioStudio1.2.8800.0.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\de-DE\WindowsMicrosoft.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\AdobeHunspellPluginAdobeHunspellPlugin.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\uk-UA\SoftWaresdffdfc.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\sdffdfcSoftWare.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\UpdateUpdate1.3.36.371.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\it-IT\sdffdfcSoftWare1.2.8800.0.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ExplorerSystem.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\ToolsTools10.0.60828.0.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\GoogleChrome.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\es-ES\sdffdfcsdffdfc1.2.8800.00108171148.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProvidersUIAutomationClient.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Multimedia Platform\WindowsMicrosoft.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\ja-JP\sdffdfcsdffdfc.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\EmbeddedBrowserWebViewWebView92.0.902.67.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\it-IT\sdffdfcSoftWare.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WorkflowSerialization3.0.4506.9141.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\de-DE\mpvisWindows.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\en-US\ieinstalInternet.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\miniinstallerInstaller.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\es-ES\operativoEppManifest4.18.1907.16384.160101.0800.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\uk-UA\Exploreriexplore.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\it-IT\Windowsmsdaprsr.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Updatesdffdfc.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\SoftWaresdffdfc.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\WindowsOperating.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceserviceinstallermaintenanceserviceinstaller.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\it-IT\setupwmmpvis.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\sdffdfcsdffdfc1.2.8800.0.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\WindowsPowerShell.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\uk-UA\mpvisWMPNSSUI.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\WindowsOperating.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\UpdateUpdate1.3.36.371.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler47libGLESv2.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\LibraryLink.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelpermsedgeproxy.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ietoedgestubexeietoedgebhodll.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\sdffdfcsdffdfc.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\sdffdfcSoftWare.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\sdffdfcSoftWare.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\it-IT\ieinstaliexplore.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\OperatingmshwLatin.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\de-DE\msadcermsdaremr.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\wmlaunchoperativo12.0.19041.1.160101.0800.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImplAdobe.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\fr-FR\mpasdescEppManifest.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\ja-JP\SoftWareSoftWare.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\VisualStudioMicrosoft9.0.30729.7079.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\resourcesresources.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkDivMicrosoft.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\Windowsdexploitation.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewerWindows.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\it-IT\SoftWaresdffdfc.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ANGLEd3dcompiler47.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AXSLEEula.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\SoftWaresdffdfc1.2.8800.00108171148.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\uk-UA\Windowsmpasdesc.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\Windowsdexploitation.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagementMicrosoft.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\SoftWareminiinstaller.exe aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe 4304 aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aafd07250b10dba751c403ec6edad678_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD5aafd07250b10dba751c403ec6edad678
SHA1375d4b8c47d086cdff296fc193a44368ebc4dfc9
SHA2560a0907f1b2c5dc696441663a02228a824b3e095ed051607a75374d0df9f28be1
SHA51207bd9a47a27040c390f3860c17337b52179ce7921308fedc365411a9dada52d92e2cf3eb824662e901c2264b83b6ec568677b9bc4ee8ce78414aff74770c4373