Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 01:00
Static task
static1
Behavioral task
behavioral1
Sample
281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
-
Size
87KB
-
MD5
281d30ff9aedb2d4ad9fed57faa786c2
-
SHA1
ac6a3c95cbfb3e32e700a88e20a99032b4cedc73
-
SHA256
0e1f1086d8e50e261d3c5182171f5d56cea4d376add5434412c1dd9fd2d17df9
-
SHA512
75552872fa111d20b1db50db157ad50b39497d772fa4158b1244595e0a1095c3d60c881894a1bd13c8b353d82d60736445de6904daa73f9941078acb10383272
-
SSDEEP
1536:yOF3OLr5Oi3hhOSmXjQXNhXm558NSY1WMaUXXunq:DO/vwXwNhokSTjE
Malware Config
Signatures
-
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File created \??\c:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File created \??\c:\Program Files\desktop.ini 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\desktop.ini 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jmc.txt 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\orbd.exe 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\serialver.exe 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bn.pak 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Internet Explorer\iediagcmd.exe 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\tabskb.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.cpl 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3684 4464 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4464 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 9482⤵
- Program crash
PID:3684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4464 -ip 44641⤵PID:3524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD505a522bfcb1f62f3ceb4c0a14e9eb525
SHA15a6b7091da48fe1b0de60325e07f4a4aded63919
SHA25691734047589c326e70e0de090f9a1c6e0f695d034e87ef0df18cb32e181f18f6
SHA5120e830cbf8320faa44dc0e555bfeae7e464767e1d55b8a6b87819c32e399a6722ddaa02be782d67efe2eb6efa7c27db4645850bd72b457067bb586337573778b0
-
Filesize
5B
MD5b5b682b742431a52ea8b17c72ad9c572
SHA1326320f469235708c59f678c9a7357dca552d306
SHA25630d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
SHA5124e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
-
Filesize
119B
MD5da7c482f5358bd9da5bbfe76e3447a8e
SHA1dc0e0a748e790dc04133c65b52cd69b1676bd9c2
SHA2564a4c9f290dadb6052556670faf60e07f0cc3c6f5a7b478d2da2234be8ea5508b
SHA512e9bb5f64535ebed8a4f38bc4144b3dc4dedcf6a3010a87a0cfa2306fbdc5ce8d3e9fd00ad9ae019548b3085edca33283c507325a6c484f66b484778a035878bc
-
Filesize
118B
MD5805ae32d41bd54cee2613872031b2c20
SHA15c2201ef44d4c345c2ad40bf67c3cb5f17509bad
SHA256641723ac1f2a767466006fb811f8140370ef9f2904398ee77f160c0e7bda7ba0
SHA512a40328c1800ff312c79e873b9cdc1cc8fd4b61629fcf379257401b167c45fa53c3a019eb1bc6fb55ae8e9e74b9ad8e226163d75918f564e787f57696670688b0