Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 15:56
Static task
static1
Behavioral task
behavioral1
Sample
3ae0164b5e4d31e6f7b6eacffc9b6571_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3ae0164b5e4d31e6f7b6eacffc9b6571_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/installer5.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/installer5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
General
-
Target
3ae0164b5e4d31e6f7b6eacffc9b6571_JaffaCakes118.exe
-
Size
269KB
-
MD5
3ae0164b5e4d31e6f7b6eacffc9b6571
-
SHA1
74be75a457df411da2f665fd9c8275dc5dc655ab
-
SHA256
6b2fee8e0efdef0ee1e942e863f28282a3be178b2e2ad0fac82cf8c842cbd955
-
SHA512
8a2155c64cc2a1137fbcf37a013b851890cec9f1358d615f97b272b033be97219e8c1d763bebaa54e71f3cc45d7639653a2611b76f25ffdd750bdb387147d9bc
-
SSDEEP
6144:6saocyLCk+fqKKGcZUxA4gP3xZF7vbIEHXYLC8fbVXt:6tob3+fyzZUWv97vHXQ/fbVXt
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation installer5.exe -
Executes dropped EXE 2 IoCs
pid Process 5080 installer5.exe 220 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe -
Loads dropped DLL 1 IoCs
pid Process 1560 3ae0164b5e4d31e6f7b6eacffc9b6571_JaffaCakes118.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini installer5.exe File opened for modification C:\Windows\assembly\Desktop.ini installer5.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly installer5.exe File created C:\Windows\assembly\Desktop.ini installer5.exe File opened for modification C:\Windows\assembly\Desktop.ini installer5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ae0164b5e4d31e6f7b6eacffc9b6571_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language installer5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 installer5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8120f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60168000000010000000000000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b81190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 installer5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 5c000000010000000400000000080000190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b816800000001000000000000007e000000010000000800000000c0032f2df8d6010b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748506200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8122000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 installer5.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 220 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 220 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 220 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe 220 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1560 wrote to memory of 5080 1560 3ae0164b5e4d31e6f7b6eacffc9b6571_JaffaCakes118.exe 84 PID 1560 wrote to memory of 5080 1560 3ae0164b5e4d31e6f7b6eacffc9b6571_JaffaCakes118.exe 84 PID 1560 wrote to memory of 5080 1560 3ae0164b5e4d31e6f7b6eacffc9b6571_JaffaCakes118.exe 84 PID 5080 wrote to memory of 220 5080 installer5.exe 88 PID 5080 wrote to memory of 220 5080 installer5.exe 88 PID 5080 wrote to memory of 220 5080 installer5.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ae0164b5e4d31e6f7b6eacffc9b6571_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3ae0164b5e4d31e6f7b6eacffc9b6571_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\nsw8966.tmp\installer5.exeC:\Users\Admin\AppData\Local\Temp\nsw8966.tmp\installer5.exe 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe /t /dT132051225S /e5818302 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\nsw8966.tmp\4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe"C:\Users\Admin\AppData\Local\Temp\nsw8966.tmp\4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe" /t /dT132051225S /e5818302 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:220
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD522371a8f60488d167c752cf965f25237
SHA12119a78137f0188003fc312a02b12d2b842a2ef5
SHA256e522bbb4e53e1fe3d4d4e3a8dc925d96afe02b1e50b604ef8e2a6abf194120ac
SHA5123dcda9a228eea334726f3b621cbda96440f4434bb0e7fe36bd40a082aa6ab2d284fb8c61e7e10770aeb4c4968ac3711cb257d2b559643ed883886b64f49946d8
-
Filesize
215KB
MD5029162f299af12e48fc5ffde104766e2
SHA1467b9336af5aec76cbb548ece146cd2d7b4e1264
SHA25628e778a7e5f91d27cf37e7ed8624adb8e9f33d7d12d64ed6420b5345052591b0
SHA512fa522ef2364e5a31c119993d8057a3337bffdb7ce259b810efeb59e105885c8ca75086e1d568121600a919ad160e3be2667486ab56de7e7393df8d895293863c
-
Filesize
8KB
MD5249ae678f0dac4c625c6de6aca53823a
SHA16ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201
SHA2567298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce
SHA51266e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7