Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 15:12

General

  • Target

    e2d18966d4665fb34cbbccad4c87e2cc_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    e2d18966d4665fb34cbbccad4c87e2cc

  • SHA1

    249e4de741f006cb0d755e37b587f8cf3d638745

  • SHA256

    b7736ffd44d69a16213a96e771fae8d39546a2240b788971edeefe145d382268

  • SHA512

    1138c643e40e8428ef177d169491b02e872c145887eb3d89a316c8e082bd0eee48cbce3b05e05b67650599790b6cc959a1f83b6fd174cb573141341e7b4aed2f

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj69:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Q

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2d18966d4665fb34cbbccad4c87e2cc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e2d18966d4665fb34cbbccad4c87e2cc_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Windows\SysWOW64\mtqsrgnzht.exe
      mtqsrgnzht.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1848
      • C:\Windows\SysWOW64\bnutxamt.exe
        C:\Windows\system32\bnutxamt.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1408
    • C:\Windows\SysWOW64\ssikaxeilhffyvv.exe
      ssikaxeilhffyvv.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4172
    • C:\Windows\SysWOW64\bnutxamt.exe
      bnutxamt.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:220
    • C:\Windows\SysWOW64\zydgtlgfhwivc.exe
      zydgtlgfhwivc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3576
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    512KB

    MD5

    a191a5a92759fca019302b4580f2fe78

    SHA1

    21af26007348a6f508d7f941d0dabf3f3c8207b3

    SHA256

    2d10db635d40c1478b9314b731111611feff59b033f6364b12b5ef042ad3644d

    SHA512

    3e9dc77c0e6e888d0e1c523be80c31daeb360daf97beedad422cccb004b93aed9f5efdb176b9cf27abdec95e31ca66c625c43af4d18a20794a33c9d26625d217

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    512KB

    MD5

    5ed0043db2102395f69cf705926bd134

    SHA1

    aec4692c5b951f7aac0f93c972645078058adcde

    SHA256

    89c9aab69d70c5c7f3360bcb750c74df3bd9be3a120990e5e81715f6a2c7364a

    SHA512

    0ed2af6b628fc72c83db7c2610223a82985c2e3e59f1cd1075d33ee122be658742a0478a274248db101fc0a40686cad89dc6c482017a8b05cff2270480f0767e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    239B

    MD5

    c7667c3371d5d84c2c3d9801baa3dc0f

    SHA1

    25838b0056cd399422f492754b6437a95f318e52

    SHA256

    5596446f922d237efed146d488ec6e529f0d66a064960eeb6013773cfa45ab9d

    SHA512

    7e42fc3aad97260c7973eb4adb8dca390a207f2f8dee0c45f74e7e91441d9f548aa8ae03f7f6109e772bc67a8e6124e74bc37a0496120a0200f58d9e96451a09

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    a480a3b75acc3359bd3eef8188685e3c

    SHA1

    892e16fcec2b3fa743f093ad0c0c57eada7d0272

    SHA256

    42b142026408aef460ec0aaa4842774556bbd3aae3d98c734de52e474c024933

    SHA512

    580b489db3fbfd199715881fb911e1c8b467ed8177271e70c95d2d52c52d2a064ab4fd53ce9882f227cff141e9b8b80a914e59a993476facb5a970075b854fc0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    863f957b397e04bcb93109ae3e7cc00c

    SHA1

    a160591e41f0c7fbbeb41a48cf335ed35d305ed6

    SHA256

    75841d48da974107f03ef00ba8a16c15ecceddd3c1dee2f878cbf8921e7547e8

    SHA512

    cba44acd569c0cb3d74f720f8509e798274c9fb387ec16bf331ce53e7c95b41ca4b116a674d7e5d59705eac7cde18d26546efd52ae20e83693a9f04939bab155

  • C:\Users\Admin\Desktop\CompressUninstall.doc.exe

    Filesize

    512KB

    MD5

    c3d70021834a19c1b8fc231549125fee

    SHA1

    99ebc8ed8b5c2b8a08077d7ab9408f872a83e684

    SHA256

    8224787d93da6f3c087ee68ef4ce409aaf411af8cf72bf4d6392d074448e1fed

    SHA512

    abffa7b2187915f43f78c1534db48fc2f114b0af05f6b0e06dbf4bfcab68075b88aed3ddefc967da466d31a801986b580b675b352271a802158dc6caab1f8932

  • C:\Windows\SysWOW64\bnutxamt.exe

    Filesize

    512KB

    MD5

    1af9a4f1f70648b5cd42a26bbf3e5535

    SHA1

    897dd8ee97135fcc331a892ffd04a3c4017df8d2

    SHA256

    24fc683b889485e71d9a75b6729dae27780c9a447ee98f4fa30070f7f63aaa23

    SHA512

    5d84495f23f638d713204e951ecbeb44c2b415046fd9275c1b8d4d8c1dcfd80d4409561d98078ea9bd8f354c686bb450b938e5fcd3040b3d425be118ba77496f

  • C:\Windows\SysWOW64\mtqsrgnzht.exe

    Filesize

    512KB

    MD5

    ef0ff8da8178896373a6d33bda155e56

    SHA1

    c4efec58bfb390782d4861a2279bb97360bc2d0d

    SHA256

    322e899b375d92df125b77faca2cdcfdbff348505a3f0160e006532b4863e691

    SHA512

    e2bba970fb515491caf7b816be51bdd97c74a62178f319f5e6cdd8409bb0a8f7a1e23eed355c30ce8e1a98e9a379d7598c6cb144cf0e8828d2848b35e582706e

  • C:\Windows\SysWOW64\ssikaxeilhffyvv.exe

    Filesize

    512KB

    MD5

    30432e8c56832c20cadc16e7ce510a57

    SHA1

    fa01c173b6371958b4e36a4e1b528a7e31b53dcc

    SHA256

    8228b64c218f623bbf97fa3639320964dea9c201ebe43989d55ca4ca73b2da1a

    SHA512

    fefdfff67713dbeb77ca5dd62fc5340ff55869fa66b4a0dc4a0bd6e3b7dfe4c3e5fedc3466fe05552cacde3f677b7a92a5d61ae1564e3da3f3e2cf2496397823

  • C:\Windows\SysWOW64\zydgtlgfhwivc.exe

    Filesize

    512KB

    MD5

    0de48a9899940dc5c9a1d45528169c93

    SHA1

    d5191af96f760bd505636b482ed2a0b6e08ef4fe

    SHA256

    e69eb96a2e9f26ca55801d2c95573f8a7b5e65e5c4d25edd83a2140278f28f44

    SHA512

    ce7f5b2fe8403650e0eb9be68e7cfdbea7d123732818c2c44f294302e52c68aca87c443ff5d511820e85378c5bd6ac69c9860ba43a48ce34d33dfb5d90dca00b

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    f1ec67d98980f2f21c5cee9ce4444c31

    SHA1

    a1a2e55bda352c1c4c33640637c810f2d8e0705d

    SHA256

    1128af3f24733f419575b0982aa04ccd8d3b19b0d997e073800c35bb3413eb11

    SHA512

    c1083c0225cb9f024e7b423244e8281cc5621eefc3f57c17b806e15fbc186192ba037dd4df3ea49a312fbaafbd4e1c212a51ab363a4f731babdd24177bd213e9

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    e274e939692ff87c3a3f705561eb03fd

    SHA1

    684ee1e2fbb67dd4bf59b4db84a4ce197290c76b

    SHA256

    b22795f37c7e1b46f47bb5b0429b1d17e86613cf74838c0bc30a759ca05dfa5f

    SHA512

    a679cdf9b89fa2eae6561fbc07ac8f6a04e0be8f15c1094ecddf7ab53ee0ac5e6481d1daa2119ddb7fac6bda99f625c9fcef7406183c2f9b39ce748a46ebc89e

  • memory/2888-42-0x00007FF8DFD30000-0x00007FF8DFF25000-memory.dmp

    Filesize

    2.0MB

  • memory/2888-37-0x00007FF89FDB0000-0x00007FF89FDC0000-memory.dmp

    Filesize

    64KB

  • memory/2888-47-0x00007FF89D990000-0x00007FF89D9A0000-memory.dmp

    Filesize

    64KB

  • memory/2888-45-0x00007FF89FDB0000-0x00007FF89FDC0000-memory.dmp

    Filesize

    64KB

  • memory/2888-44-0x00007FF8DFD30000-0x00007FF8DFF25000-memory.dmp

    Filesize

    2.0MB

  • memory/2888-43-0x00007FF89FDB0000-0x00007FF89FDC0000-memory.dmp

    Filesize

    64KB

  • memory/2888-41-0x00007FF89FDB0000-0x00007FF89FDC0000-memory.dmp

    Filesize

    64KB

  • memory/2888-133-0x00007FF8DFD30000-0x00007FF8DFF25000-memory.dmp

    Filesize

    2.0MB

  • memory/2888-40-0x00007FF8DFD30000-0x00007FF8DFF25000-memory.dmp

    Filesize

    2.0MB

  • memory/2888-39-0x00007FF89FDB0000-0x00007FF89FDC0000-memory.dmp

    Filesize

    64KB

  • memory/2888-38-0x00007FF8DFD30000-0x00007FF8DFF25000-memory.dmp

    Filesize

    2.0MB

  • memory/2888-46-0x00007FF89D990000-0x00007FF89D9A0000-memory.dmp

    Filesize

    64KB

  • memory/2888-103-0x00007FF8DFD30000-0x00007FF8DFF25000-memory.dmp

    Filesize

    2.0MB

  • memory/2888-104-0x00007FF8DFD30000-0x00007FF8DFF25000-memory.dmp

    Filesize

    2.0MB

  • memory/2888-105-0x00007FF8DFD30000-0x00007FF8DFF25000-memory.dmp

    Filesize

    2.0MB

  • memory/2888-130-0x00007FF8DFD30000-0x00007FF8DFF25000-memory.dmp

    Filesize

    2.0MB

  • memory/2888-129-0x00007FF89FDB0000-0x00007FF89FDC0000-memory.dmp

    Filesize

    64KB

  • memory/2888-131-0x00007FF89FDB0000-0x00007FF89FDC0000-memory.dmp

    Filesize

    64KB

  • memory/2888-132-0x00007FF8DFD30000-0x00007FF8DFF25000-memory.dmp

    Filesize

    2.0MB

  • memory/2888-128-0x00007FF89FDB0000-0x00007FF89FDC0000-memory.dmp

    Filesize

    64KB

  • memory/2888-127-0x00007FF89FDB0000-0x00007FF89FDC0000-memory.dmp

    Filesize

    64KB

  • memory/2888-134-0x00007FF8DFD30000-0x00007FF8DFF25000-memory.dmp

    Filesize

    2.0MB

  • memory/4880-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB