Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 18:01
Static task
static1
Behavioral task
behavioral1
Sample
de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe
-
Size
130KB
-
MD5
de9f3f3fde903ad30e122fdd71ae7bab
-
SHA1
3879316b3a5e99ff0e8b69f9c3ee58f8cf706e31
-
SHA256
46db75d61d9cb7aa6e22b6dbedb29c301d10612518384aa4cc5dae63253d193d
-
SHA512
2544baa6fa1600ca47376cdcd274b65c7f611abad5d52ab1e091c71189f1aba634a4c7f62ee893b8f0986657ed5d64e039eaa7aa619e7ef18ed1baaf90128b1f
-
SSDEEP
3072:51B31bdBob2QXsFKVTx0QwH9dT7JuucVUoHkQKfZf:5731bdBaBsFGx0QwddPJurV8fZf
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\sIRC4.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\initial_prefere.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX6D1.tmp de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\initial_prefere.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX6F1.tmp de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\createdump.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\mip.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\dotnet.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OSE.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX731.tmp de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevation_service.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\dotnet.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\de9f3f3fde903ad30e122fdd71ae7bab_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5c28efdd834ed453de90e550a8052f4b6
SHA11b4bd9e6b5254afdffa1d67e4f7f41fd320baee3
SHA256ef1d62466f858e8f95d22c09679542c14ed2e711b64c7c75f5dd9edbd6da0ce3
SHA512650ddc81119bf722a1af9ad01b5b76997b7cdcd075ea1a34f60ddc14902f1d0238eb8c272e83cefa2ee9f840097daedbe230049a1e7a7c1427ab9fcab30c1d47
-
Filesize
930KB
MD588b53bc75de739d744a0d8b8a7a88f68
SHA193641f38588c47b63957138525e49eeeaa4fbc62
SHA256af1a4f394c503333750fa60cce5962132826c78c65086cde2c87519ef5872fb6
SHA5124cfbd44c53381ccf36d2ffaa27c9e72dd082dde1958c0f5bbdd969c5500e7c582e4fa251a83a80955979bc352212f496de4fa188cd4eaea3f3eb213d7a474b8b