Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    09/04/2024, 04:02

General

  • Target

    e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe

  • Size

    18KB

  • MD5

    e92d48423426636c44cdaf8e16a22129

  • SHA1

    001bb2a29e431bc21cbb0b8ec6e70edbbbb166b6

  • SHA256

    7f50065b78e13e0ab94df1973f672fbe72a497953a67b54675e69ea2be5cb0bc

  • SHA512

    03f85e32b45918009ba9934cb88f8473016d20311d52c1a9424f4f86390ace16739c677952fb2a9067adceef3e0873b6e21059c62e7670778d83b7d7704bb428

  • SSDEEP

    384:rfCv/LONr7/AVnEZD2CM5JjzqKj8BcpextpKqI2moQgywUftt:rW/LONr7oVnkaCM7dj8BcpUtGafHct

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies Internet Explorer settings 1 TTPs 11 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Loads dropped DLL
    • Installs/modifies Browser Helper Object
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Windows\SysWOW64\ctfmon.exe
      ctfmon.exe
      2⤵
        PID:3040
      • C:\Users\Admin\AppData\Local\Temp\sbsm.exe
        C:\Users\Admin\AppData\Local\Temp\sbsm.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2456
        • C:\Windows\SysWOW64\ctfmon.exe
          ctfmon.exe
          3⤵
            PID:2552

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Local\Temp\sbmdl.dll

        Filesize

        7KB

        MD5

        c4c23c0e84d7e93646ffcc75a223f2df

        SHA1

        76d31fd1458c9214b7f3d198627c947e41ca091a

        SHA256

        7dab81419287e7701fc28bf293975c9ef332c7b7ba89d42ae342cb6a905d55b3

        SHA512

        f49d19adf6fe151334a821d1d890aa3f0d33e2fb29988d43b16fde2b44676cd6265d1c001fd6f791fb97acb71776ae07099e38756cd755355a5464aff3d81582

      • \Users\Admin\AppData\Local\Temp\sbsm.exe

        Filesize

        5KB

        MD5

        a75bb6cb77e48934cafb1636ddac8e40

        SHA1

        24f59e14dccd7909422c9565f4e2da9b8691b25c

        SHA256

        16731a3ee7a14a35d3aafd4e5c1398fe68bed73882bbbb25534c71734c482786

        SHA512

        4ca8b6528bf071406c1bff37ee8bc9488b9762335f731bdba2e171d17f1b048c3c848cfa5c46afa08f5f18c158dc03e89ef801ba5d5f71aa4c17fa1e60d68e51

      • memory/2456-15-0x0000000000400000-0x0000000000408000-memory.dmp

        Filesize

        32KB

      • memory/2896-1-0x0000000000400000-0x000000000040D000-memory.dmp

        Filesize

        52KB

      • memory/2896-4-0x0000000010000000-0x0000000010009000-memory.dmp

        Filesize

        36KB

      • memory/2896-14-0x00000000001B0000-0x00000000001B8000-memory.dmp

        Filesize

        32KB

      • memory/2896-13-0x00000000001B0000-0x00000000001B8000-memory.dmp

        Filesize

        32KB

      • memory/2896-16-0x0000000000400000-0x000000000040D000-memory.dmp

        Filesize

        52KB

      • memory/2896-20-0x0000000010000000-0x0000000010009000-memory.dmp

        Filesize

        36KB

      • memory/2896-21-0x00000000001B0000-0x00000000001B8000-memory.dmp

        Filesize

        32KB

      • memory/2896-22-0x00000000001B0000-0x00000000001B8000-memory.dmp

        Filesize

        32KB