Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    164s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 17:30

General

  • Target

    e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe

  • Size

    4.3MB

  • MD5

    e579348f0efa5c965fa570e7da12d056

  • SHA1

    70faa1e256d616121141c073b3ec6443f9de469d

  • SHA256

    5d4447c12af07349b13f38c6d0dd226915a27a7bba6aa40b7b65ea6a87e3a305

  • SHA512

    100e266a4a297ecee254f0398ca9c717ac972b236e3165b1a9736c6da31cb39b2127979610f070766539b14f1701fa4fcc41248f95d71f5f8a4a995d18b84644

  • SSDEEP

    98304:mOcd1iEPw3V56K3U9+JYhfF5kt03XzzO6bcSiUyo2GE:mO+QE2V5++JYASDzO6biz5GE

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies registry class 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\programdata\1.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:984
      • \??\c:\programdata\aimware.sfx.exe
        aimware.sfx.exe -p123 -dc:\programdata
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\programdata\aimware.exe
          "C:\programdata\aimware.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4380
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\programdata\windows\install.vbs"
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:2516
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\ProgramData\windows\install.bat" "
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3596
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im rutserv.exe
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4760
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im rfusclient.exe
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2980
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
                7⤵
                  PID:4692
                • C:\Windows\SysWOW64\regedit.exe
                  regedit /s "regedit.reg"
                  7⤵
                  • Runs .reg file with regedit
                  PID:3468
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 2
                  7⤵
                  • Delays execution with timeout.exe
                  PID:4628
                • \??\c:\programdata\windows\rutserv.exe
                  rutserv.exe /silentinstall
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:720
                • \??\c:\programdata\windows\rutserv.exe
                  rutserv.exe /firewall
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:916
                • \??\c:\programdata\windows\rutserv.exe
                  rutserv.exe /start
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:4104
    • \??\c:\programdata\windows\rutserv.exe
      c:\programdata\windows\rutserv.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3924
      • \??\c:\programdata\windows\rfusclient.exe
        c:\programdata\windows\rfusclient.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3560
        • \??\c:\programdata\windows\rfusclient.exe
          c:\programdata\windows\rfusclient.exe /tray
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: SetClipboardViewer
          PID:3996
      • \??\c:\programdata\windows\rfusclient.exe
        c:\programdata\windows\rfusclient.exe /tray
        2⤵
        • Executes dropped EXE
        PID:3364
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2276,i,1205556100727695622,5044463180471657307,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:3100

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\aimware.exe

        Filesize

        4.0MB

        MD5

        8f5f1e00b524b066e052836fd9504aaa

        SHA1

        4dafcee2a6743385ec72240146eeeb884a2d47fe

        SHA256

        79e13b0d4703411069ba6794fdc60eba0edad50e2fe0a1afe25e029a87617a28

        SHA512

        6aa3bd4ab3d05652980da22ce2c88c9452f379dd78173c3827806256e0474f14654b20b72d4b910390a40d84ee9afa676c6ffc98fb23945f7f91475948f67373

      • C:\ProgramData\aimware.sfx.exe

        Filesize

        4.2MB

        MD5

        37726e188c9973ba3a0a4de57f96acc2

        SHA1

        0668e13cb10947603afccb75b8389d0571199c05

        SHA256

        44f4edd71d129500693ed4f14d1977527b23cb5b3139b0f4e26ae8dd7c9ff19c

        SHA512

        e24935dc1ab74decc2b18ebba8e4b4cfb0564b2735c9a275c5a679eeb8dbaee9cbfbaa551d734cffd252a61088f25ad217ffa00b7e0cebcbd53605af4d5e22ec

      • C:\ProgramData\windows\install.bat

        Filesize

        480B

        MD5

        99db27d776e103cad354b531ee1f20b9

        SHA1

        0b82d146df8528f66d1d14756f211fd3a8b1b91a

        SHA256

        240020a1a1941d1455135b5cb134e502a13b148be16cbb1552482aa03c29f8f3

        SHA512

        bc2ed33495c0a752397b2f1b9b7ba65f94ea5be82dde74c618342c83b68f1b92a4783b672cd427843533799e1af0875e0fd000b12236852e9e2fa93005d7ac69

      • C:\ProgramData\windows\rutserv.exe

        Filesize

        1.7MB

        MD5

        37a8802017a212bb7f5255abc7857969

        SHA1

        cb10c0d343c54538d12db8ed664d0a1fa35b6109

        SHA256

        1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

        SHA512

        4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

      • C:\programdata\1.bat

        Filesize

        38B

        MD5

        10b10fec28fbccb28922b7ad20536150

        SHA1

        74a2327ebba2f695da13095a70f5161450b915aa

        SHA256

        07420e294de66019f7fbaa4f87da9ee9dc7389cda09af38f7040f3cacda21dfb

        SHA512

        d215c21000a213aa41a1599e269f704e31d96f7c4713962cac6a8bb8ef21f92b70aa257cd98d63496ffb220008b22d36d9ee52a66fa939f7fe59697b8a9c3729

      • C:\programdata\windows\install.vbs

        Filesize

        117B

        MD5

        65fc32766a238ff3e95984e325357dbb

        SHA1

        3ac16a2648410be8aa75f3e2817fbf69bb0e8922

        SHA256

        a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420

        SHA512

        621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608

      • \??\c:\programdata\windows\regedit.reg

        Filesize

        11KB

        MD5

        09ab259233e0f0880f2e2446f93cd88a

        SHA1

        03b9c6469c90023569f1884494504e2d3d6bbbc6

        SHA256

        7f6e5d028aed528ad7af7672b53526a88a10846c5cf1e49bac3aeff5849a20cb

        SHA512

        babc9e8d611476452026f60d61ee2a5bc2fc3d6303cfee60e894e7f0a4a8e2bd6195d52674cffb96b38c546296ed2c19eebd7aea98ffd5292f328d0f3e9da090

      • \??\c:\programdata\windows\rfusclient.exe

        Filesize

        1.5MB

        MD5

        b8667a1e84567fcf7821bcefb6a444af

        SHA1

        9c1f91fe77ad357c8f81205d65c9067a270d61f0

        SHA256

        dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

        SHA512

        ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

      • \??\c:\programdata\windows\vp8decoder.dll

        Filesize

        155KB

        MD5

        88318158527985702f61d169434a4940

        SHA1

        3cc751ba256b5727eb0713aad6f554ff1e7bca57

        SHA256

        4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74

        SHA512

        5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

      • \??\c:\programdata\windows\vp8encoder.dll

        Filesize

        593KB

        MD5

        6298c0af3d1d563834a218a9cc9f54bd

        SHA1

        0185cd591e454ed072e5a5077b25c612f6849dc9

        SHA256

        81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172

        SHA512

        389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

      • memory/720-42-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/720-45-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/720-46-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/720-47-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/720-44-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/720-43-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/720-41-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/916-53-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/916-52-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/916-54-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/916-55-0x0000000000C90000-0x0000000000C91000-memory.dmp

        Filesize

        4KB

      • memory/916-56-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/916-49-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/916-51-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/916-50-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/3364-112-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3364-130-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3364-86-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3364-95-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3364-84-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3364-82-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3364-89-0x0000000002530000-0x0000000002531000-memory.dmp

        Filesize

        4KB

      • memory/3364-80-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3364-88-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3364-113-0x0000000002530000-0x0000000002531000-memory.dmp

        Filesize

        4KB

      • memory/3364-120-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3364-107-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3560-85-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3560-77-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3560-78-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3560-81-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3560-87-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3560-90-0x0000000000B90000-0x0000000000B91000-memory.dmp

        Filesize

        4KB

      • memory/3560-83-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3560-94-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3560-106-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3924-69-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/3924-105-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/3924-70-0x0000000001300000-0x0000000001301000-memory.dmp

        Filesize

        4KB

      • memory/3924-68-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/3924-67-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/3924-93-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/3924-66-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/3924-65-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/3924-135-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/3924-128-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/3924-118-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/3924-114-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/3924-110-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/3924-108-0x0000000001300000-0x0000000001301000-memory.dmp

        Filesize

        4KB

      • memory/3996-104-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3996-100-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3996-103-0x0000000002630000-0x0000000002631000-memory.dmp

        Filesize

        4KB

      • memory/3996-97-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3996-98-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3996-102-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3996-101-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/3996-99-0x0000000000400000-0x00000000009B6000-memory.dmp

        Filesize

        5.7MB

      • memory/4104-62-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/4104-60-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/4104-61-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/4104-59-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/4104-76-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/4104-58-0x0000000000400000-0x0000000000AB9000-memory.dmp

        Filesize

        6.7MB

      • memory/4104-63-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

        Filesize

        4KB