Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 14:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe
-
Size
457KB
-
MD5
e06d4c35c8f7a216200e09343ce47280
-
SHA1
926b034f9da387563012161fcd0f310edf30f1fa
-
SHA256
5a16dc37bbd2dc4f4c37a1291113d48b90adb5895aa1e2a8b82aa15b5e833a13
-
SHA512
15ec581366c0a5726ff571c41214e70a6c71dcdaa85a531f346b4b4aac5a3fa0c0c8afb93cdc174bd50fffc82b681f42f5c337bbcc7a4afc8ee98d7d98519745
-
SSDEEP
12288:C+kOfeCHCGyCzkDxqO/hwAWLFfwhPhh4V/:6uCGyCzk9d/elfIUB
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2112 e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe 2112 e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\2 ÞØ8 e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ò4 -Þ˜ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\2H ç¥ÞØl e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r õßµ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ò þƒà˜< e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\2 ͳÞØ' e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\òˆ µ÷ߘ¬ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r‡ fVठe06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\òê nޘΠe06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r& —à e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ò4 'Þ˜ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\òâ …Oà˜Æ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²p ¯{âXT e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\2› –ýR e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\rP çÝu e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\2) ¿tÞØ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\2 ¦ÛÞØ´ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\rK —·ßp e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²– ößX² e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²> =HáX e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²+ †‰âX e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r lÞ6 e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ò„ v›Þ˜ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\rê ÅðßÏ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\² +àX( e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²Í ÆùàXé e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²à GùáXÄ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\òÛ ÌÞ˜ÿ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\rÞ ¿!âû e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\± e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ò\ Ý0à˜ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r« ¿à e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ò ¦Ïà˜? e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\2 ¥ªÝØ5 e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r õ´Þ" e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r§ ~Nß„ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r Ouá: e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r* Îáá e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²u gâXQ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\2Í .%âØé e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²j ÕáXN e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²& wÞX e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\2ì ¥‚ÞØÈ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²Z ¯OßX~ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\2& WæßØ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r‚ ¢à§ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ò ¨á˜. e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\rw ýÓáT e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\rº l⟠e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ò Þ˜' e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²£ =\àX‡ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\rc ïhàH e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\2; Õ‰àØ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²ü _¹áXØ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\òq >Þ˜U e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ò¶ §°ß˜’ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r4 f~ß e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\2_ ‡^àØ{ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\òÙ öMá˜ý e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\rÄ óáá e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²2 ÞX e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²Ï ¯{ÞXë e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ò$ >±á˜ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\2ë ÷öáØÏ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe -
NTFS ADS 15 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\òù :à˜Ý e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r Fuá: e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r Ouá: e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\² âX: e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\² âX: e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ò o:Þ˜´ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\òù :à˜Ý e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\r Uuá: e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ò f:Þ˜´ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\ò u:Þ˜´ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\òù :à˜Ý e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²{ N:áX_ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²{ W:áX_ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\²{ ]:áX_ e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\baidu\bar\BDBar_tmp\² þâX: e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2112 e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe 2112 e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e06d4c35c8f7a216200e09343ce47280_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5fbb26d78650a4024df4df5dcf1cc3444
SHA1385c6a0be1778934f9a5957d86dd89d1d8a7f018
SHA256dabe25b51944dc1427cc640a653bdd646a37d9aa027ead6f7f54d435bdf128d2
SHA5126bd616f50c9da35433e99cc16127855b6c644e8825df8ad638d50a2f94116e8cf7c10b569aed12c26ef7b3d990f7161cd72f548800ac6ed54c2a1c487381d061