Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
83s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 01:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe
-
Size
17KB
-
MD5
28a6a7f4e308cda9e6b7329a33f15d20
-
SHA1
10b5a59aca1fc7b86ba14056cc8fd9bcbcf19968
-
SHA256
8749714c61476d914cb9dd60f4da61cbdf4f4cd774a6cb0738bc43ddb1e4ce83
-
SHA512
e22921d5125fd33edee1b5e79d999816c8edeb629c26b5b406c221707535703db3e9b9835721ce342e88a3108940abba1a4811af1b6d98528213e7a4759adac9
-
SSDEEP
384:eyRq2cZsjE1XIJ0NppznwGvn3OspWzZWjEZ69w:7dJgfdTPu0EZ4w
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 53 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\xpsrchvw.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\setupugc.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tzutil.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\doskey.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ieUnatt.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\label.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\pcaui.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msinfo32.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Magnify.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rasautou.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sfc.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\WinMgmt.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\systray.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIC.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cttune.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wevtutil.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\expand.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hh.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mshta.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\icacls.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\psr.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\recover.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wininit.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\whoami.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\eventcreate.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\nslookup.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MigAutoPlay.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\control.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fixmapi.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\replace.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MRINFO.EXE 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wowreg32.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\proquota.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\icsunattend.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\twunk_16.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\hh.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\notepad.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe File opened for modification C:\Windows\winhlp32.exe 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28a6a7f4e308cda9e6b7329a33f15d20_JaffaCakes118.exe