Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 23:12
Behavioral task
behavioral1
Sample
db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe
-
Size
432KB
-
MD5
db64e021eef4e80bf5dc3d105057fdef
-
SHA1
0e0f5f5fe100daf0688adb0e5659889e0cba2509
-
SHA256
c56d074fcc09b52565e9a09cd73f190376ae552a5e190a4d682b9eeb15d72e43
-
SHA512
c432c95459788a1ff1fcde302bad2a923b1c992e472ceddae37eec1ba03a9b676970f3374aab69cbf70b0aad51ee1d4201ce8c5798163ad40d2858267ee16de4
-
SSDEEP
6144:5/n3dYapfphW6KfghETqJqFjrwK7MYE5W7LPakYxTAPiDwkrpxQVXg:5v6ap664ghfJqFjMnpqLSkIT506kpg
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\arcsas.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\errdev.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\acpitime.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\lsi_sas.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\mshidumdf.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\usbccgp.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\usbser.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\drmkaud.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\WUDFRd.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaStorAVC.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\MSKSSRV.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\nvdimm.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\urscx01000.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\usbohci.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_I2C_BXT_P.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\raspppoe.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\SpbCx.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\USBSTOR.SYS db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdgpio2.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_I2C_GLK.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSSi_GPIO.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rhproxy.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\sbp2port.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdsbs.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\wacompen.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\intelpmax.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\lsi_sss.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\stornvme.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\vmbus.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdsata.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdxata.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\hwpolicy.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\NetAdapterCx.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\vwifibus.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\evbda.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rassstp.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\spaceparser.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdk8.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\hidi2c.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\msgpiowin32.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\ndistapi.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rdpvideominiport.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\mshwnclx.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\ipt.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\usbuhci.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\Microsoft.Bluetooth.AvrcpTransport.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\bridge.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\Synth3dVsc.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\vmstorfl.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\bxvbda.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\Microsoft.Bluetooth.Legacy.LEEnumerator.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\EhStorTcgDrv.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\megasas35i.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\processr.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\sdbus.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\USBXHCI.SYS db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\mausbhost.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\mlx4_bus.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\NDProxy.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\nvraid.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rasl2tp.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\VMBusHID.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\WdmCompanionFilter.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\hidir.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/244-0-0x0000000000400000-0x00000000004BB000-memory.dmp vmprotect behavioral2/memory/244-1-0x0000000000400000-0x00000000004BB000-memory.dmp vmprotect behavioral2/memory/244-5-0x0000000000400000-0x00000000004BB000-memory.dmp vmprotect -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\genericusbfn.inf_amd64_53931f0ae21d6d2c\genericusbfn.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\UEFI.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ufxchipidea.inf_amd64_1c78775fffab6a0a\UfxChipidea.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\urschipidea.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\urssynopsys.sys db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 244 db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe 244 db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:244