Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 19:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe
-
Size
285KB
-
MD5
072731d6ee421cfaebc9b751678cc692
-
SHA1
e47b025205b967b5ab340c56bbcaab1dbbadfa2f
-
SHA256
66d42a2a5dc1074284a2402ad3d793d5ba7dde3f11fb75fa0285f106eb6bf406
-
SHA512
c84f1ad3498d4368c31f3e4cb5b9aea0acd06aba9ccfa523e740f690a9b001b76909c47045d4dcecceb2f0fcd5b4b1469b8bcb2caaf6d31e856ce4cf910afcc9
-
SSDEEP
6144:J4w33fo8XG+CV11BOk5jQ2JktZOCgONIWwf8kQFRIDqrP2hpQAYC9DcKi:J4Iw8XrCa72J8NIrkzFRI6PYi8X
Score
8/10
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ohopef\Parameters\ServiceDll = "%SystemRoot%\\System32\\ohopef.dll" 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\ohopef\Parameters\ServiceDll = "%SystemRoot%\\System32\\ohopef.dll" 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\ohopef\Parameters\ServiceDll = "%SystemRoot%\\System32\\ohopef.dll" 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 00001378.exe -
Deletes itself 1 IoCs
pid Process 2372 00001378.exe -
Executes dropped EXE 2 IoCs
pid Process 2372 00001378.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
pid Process 3504 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 4292 svchost.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ohopef.dll 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe -
resource yara_rule behavioral2/files/0x0008000000023468-22.dat upx behavioral2/memory/2260-28-0x0000000000400000-0x000000000047C000-memory.dmp upx behavioral2/memory/2260-30-0x0000000000400000-0x000000000047C000-memory.dmp upx behavioral2/memory/2260-39-0x0000000000400000-0x000000000047C000-memory.dmp upx behavioral2/memory/2260-40-0x0000000000400000-0x000000000047C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUNDLL32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00001378.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3504 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 3504 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 2372 00001378.exe 2372 00001378.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3504 wrote to memory of 2372 3504 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 82 PID 3504 wrote to memory of 2372 3504 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 82 PID 3504 wrote to memory of 2372 3504 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 82 PID 2372 wrote to memory of 2260 2372 00001378.exe 84 PID 2372 wrote to memory of 2260 2372 00001378.exe 84 PID 2372 wrote to memory of 2260 2372 00001378.exe 84 PID 2260 wrote to memory of 4896 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 85 PID 2260 wrote to memory of 4896 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 85 PID 2260 wrote to memory of 4896 2260 072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\00001378.exe"C:\Users\Admin\AppData\Local\Temp\00001378.exe" C:\Users\Admin\AppData\Local\Temp\072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\072731d6ee421cfaebc9b751678cc692_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\RUNDLL32.exeRUNDLL32 netshell.dll,StartNCW4⤵
- System Location Discovery: System Language Discovery
PID:4896
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ohopef1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
285KB
MD5072731d6ee421cfaebc9b751678cc692
SHA1e47b025205b967b5ab340c56bbcaab1dbbadfa2f
SHA25666d42a2a5dc1074284a2402ad3d793d5ba7dde3f11fb75fa0285f106eb6bf406
SHA512c84f1ad3498d4368c31f3e4cb5b9aea0acd06aba9ccfa523e740f690a9b001b76909c47045d4dcecceb2f0fcd5b4b1469b8bcb2caaf6d31e856ce4cf910afcc9
-
Filesize
184KB
MD5aefd3e91b3bcbb5a2a2c808a5eeac07f
SHA197bb0bfc1c4e4f9688b9c6b92e081e84d23a7f34
SHA256cfe15fa88214b1983b505a5958e96e8bad2eeff3fd339c245fd9b75c0b87f90e
SHA5123bf87642fc4e80db5c9fd9ce2f35bbee10dce33601961adba379d9f14d44f2ad74c3507ec2f8ec48c317c551eec4a7a86ea1ff4cfda3beb90f053d2a205f3ac3
-
Filesize
35KB
MD55f5718f9b32048ef5db06baa99415bfe
SHA1995fb16c76d12b7eb57f1d08e481f38dc6a65b41
SHA256e445e60639bec928e735e1e50a8990df369e1376adee2c719c6c9a3a938b3512
SHA51220cfebb72467a20b7b73b8453c0649be68de8b196d642189c7f2f8e6c049d2ca664c1e05e383f2e888d05a0f232014e7f809814420524ab4ba56ed1aa7d99e6f