Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
35205816a75...18.exe
windows7-x64
75205816a75...18.exe
windows10-2004-x64
7$PLUGINSDI...am.dll
windows7-x64
3$PLUGINSDI...am.dll
windows10-2004-x64
3$PLUGINSDI...eb.dll
windows7-x64
3$PLUGINSDI...eb.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...K2.dll
windows7-x64
3$PLUGINSDI...K2.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...te.dll
windows7-x64
3$PLUGINSDI...te.dll
windows10-2004-x64
3$PLUGINSDI...nd.dll
windows7-x64
3$PLUGINSDI...nd.dll
windows10-2004-x64
3winever_ev700.exe
windows7-x64
7winever_ev700.exe
windows10-2004-x64
7$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...SC.dll
windows7-x64
3$PLUGINSDI...SC.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/WinOS.dll
windows7-x64
3$PLUGINSDIR/WinOS.dll
windows10-2004-x64
3winext.exe
windows7-x64
1winext.exe
windows10-2004-x64
3Analysis
-
max time kernel
142s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/10/2024, 12:15
Static task
static1
Behavioral task
behavioral1
Sample
5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/DLLWeb.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/DLLWeb.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/IEFunctions.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/IEFunctions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/ISCHECK2.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/ISCHECK2.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/SelfDelete.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/SelfDelete.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/processes_second.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/processes_second.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
winever_ev700.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
winever_ev700.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/WinOS.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/WinOS.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
winext.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
winext.exe
Resource
win10v2004-20241007-en
General
-
Target
5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
5205816a750cb86b88614ea22faa75b3
-
SHA1
3baadad2368136bcff6fcb8af87b6cc00aa9b6cb
-
SHA256
a30c050d5c41a945070a45ed9b547fe0d9def41a86a09cb6ca600382faf64099
-
SHA512
1d499bbb3b1eba26953f046e46ef23f6d407f958f0add500efb5d934e264042328434731a61d9f8cd00e33b5551f1190c02c52278af3d6e03a0a491c9fbd3ec4
-
SSDEEP
49152:+JoY1Zt0lF/80bvurP1mDufYZ0MynTW3B:artkW0bv+9fGynQ
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2852 5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe 2852 5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2852 wrote to memory of 5088 2852 5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe 85 PID 2852 wrote to memory of 5088 2852 5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe 85 PID 2852 wrote to memory of 5088 2852 5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c \DelUS.bat2⤵
- System Location Discovery: System Language Discovery
PID:5088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD5074b268456dbdfd4cf77824701bf00fe
SHA19fd6d14a90d2695bcda865ef4541c41ccd8dd4dd
SHA2567123f9d0c5b3a03e66afd5b1ee1d65a7befe7aa4b4a028bc36a7df9604d59096
SHA5124a9dff90a22b429d102e3f73fad236d717e1ce8ac71c78143f0be830119a10a61465a9056c359b00ac679de486f58e146e86bfeebe2de96a1723e1723891e9c0
-
Filesize
92KB
MD59b758e25eeb7298a61776391310a11f7
SHA15f05ac39f0027197e391e0ef43a3ef9ec160426a
SHA2567e58ea6ce4c690eb69b16cb1260a9d7127fcb6cdd43cfa1f360571607d9b9a9e
SHA51223f1236a0181b3735e4f311781c236b78883f8f76ee3b3ba0cd2ab6836a7977d8ea4ff16546d00d5419ed4190e584d4ceeba2389ed9c4325a84d468ee883895c
-
Filesize
24KB
MD57bf1bd7661385621c7908e36958f582e
SHA143242d7731c097e95fb96753c8262609ff929410
SHA256c0ad2c13d48c9fe62f898da822a5f08be3bf6c4e2c1c7ffdf7634f2ca4a8859e
SHA5128317af5cc3ac802eb095f3fa8cc71daa1265ca58fead031c07872f3d4bb07663a7002ae734fad392a7617f0923fe0caf1f54ed55afdf8516a6a08e202d86fa7f