Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 18:01
Static task
static1
Behavioral task
behavioral1
Sample
de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe
-
Size
130KB
-
MD5
de9f3f3fde903ad30e122fdd71ae7bab
-
SHA1
3879316b3a5e99ff0e8b69f9c3ee58f8cf706e31
-
SHA256
46db75d61d9cb7aa6e22b6dbedb29c301d10612518384aa4cc5dae63253d193d
-
SHA512
2544baa6fa1600ca47376cdcd274b65c7f611abad5d52ab1e091c71189f1aba634a4c7f62ee893b8f0986657ed5d64e039eaa7aa619e7ef18ed1baaf90128b1f
-
SSDEEP
3072:51B31bdBob2QXsFKVTx0QwH9dT7JuucVUoHkQKfZf:5731bdBaBsFGx0QwddPJurV8fZf
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javah.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevation_service.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\notification_helper.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaw.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX6E4.tmp de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javah.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\apt.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javap.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javaw.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\mip.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\sIRC4.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\msinfo32.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\apt.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\mip.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201KB
MD539db19735e127c2b78c1cbb0d9067576
SHA16d2616483a847685eaae1708f23000cd42e4474c
SHA256e4fef313339d58acc5f9d1be26577b4f031162bc4ab22c4c01f62c271f5a972d
SHA512624aef91be0bfd4a54c57c44e2d1033caee11fdca8ae085541eff47d6a562d97341456f15d6fc98e79e1c11121a4382e7806559cf7fa2d248ccdf9d1c4541679