Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    160s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 04:02

General

  • Target

    e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe

  • Size

    18KB

  • MD5

    e92d48423426636c44cdaf8e16a22129

  • SHA1

    001bb2a29e431bc21cbb0b8ec6e70edbbbb166b6

  • SHA256

    7f50065b78e13e0ab94df1973f672fbe72a497953a67b54675e69ea2be5cb0bc

  • SHA512

    03f85e32b45918009ba9934cb88f8473016d20311d52c1a9424f4f86390ace16739c677952fb2a9067adceef3e0873b6e21059c62e7670778d83b7d7704bb428

  • SSDEEP

    384:rfCv/LONr7/AVnEZD2CM5JjzqKj8BcpextpKqI2moQgywUftt:rW/LONr7oVnkaCM7dj8BcpUtGafHct

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies Internet Explorer settings 1 TTPs 11 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Loads dropped DLL
    • Installs/modifies Browser Helper Object
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Users\Admin\AppData\Local\Temp\sbsm.exe
      C:\Users\Admin\AppData\Local\Temp\sbsm.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\sbmdl.dll

    Filesize

    7KB

    MD5

    c4c23c0e84d7e93646ffcc75a223f2df

    SHA1

    76d31fd1458c9214b7f3d198627c947e41ca091a

    SHA256

    7dab81419287e7701fc28bf293975c9ef332c7b7ba89d42ae342cb6a905d55b3

    SHA512

    f49d19adf6fe151334a821d1d890aa3f0d33e2fb29988d43b16fde2b44676cd6265d1c001fd6f791fb97acb71776ae07099e38756cd755355a5464aff3d81582

  • C:\Users\Admin\AppData\Local\Temp\sbsm.exe

    Filesize

    5KB

    MD5

    a75bb6cb77e48934cafb1636ddac8e40

    SHA1

    24f59e14dccd7909422c9565f4e2da9b8691b25c

    SHA256

    16731a3ee7a14a35d3aafd4e5c1398fe68bed73882bbbb25534c71734c482786

    SHA512

    4ca8b6528bf071406c1bff37ee8bc9488b9762335f731bdba2e171d17f1b048c3c848cfa5c46afa08f5f18c158dc03e89ef801ba5d5f71aa4c17fa1e60d68e51

  • memory/3100-0-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/3100-3-0x0000000010000000-0x0000000010009000-memory.dmp

    Filesize

    36KB

  • memory/3100-11-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/4916-10-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4916-12-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB