Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

ed41a8bd2a...18.exe

windows7-x64

10

ed41a8bd2a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/04/2024, 10:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed41a8bd2aa3dfe7cd3faf3d2dc1b36d_JaffaCakes118.exe

  • Size

    93KB

  • MD5

    ed41a8bd2aa3dfe7cd3faf3d2dc1b36d

  • SHA1

    9fab6cf701e1f5c55f14cb54af31a7ba26cd04de

  • SHA256

    40fd5b6b608684192c9be7caea845e59b413b191744be405f50956ad17437ebe

  • SHA512

    84a5033b7c2c0089b81d66dc0d20741ade795af4e85647e5beef1e88f8cde5405af2f4a93f71fcfa73fa30c6c56c7cf839c9eff5caf64a86801ec9faddc6a59a

  • SSDEEP

    1536:SWFpaKwgjPw45CU9ubRpcz7FFd3CpuDOTnramH5d1rwNDmD9nv0M5dIQkwXt:BparUPvuRpmbdSADObGmH5Trt9sWdr

Score
10/10
persistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed41a8bd2aa3dfe7cd3faf3d2dc1b36d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed41a8bd2aa3dfe7cd3faf3d2dc1b36d_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\XR Changeable.exe
      "C:\Users\Admin\AppData\Local\Temp\XR Changeable.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\XR Changeable.exe
    Filesize

    165KB

    MD5

    8da622d361adcc201fe465bac42353c4

    SHA1

    d5d1e8f2e19292c295b4b94793881dbf0dbf7491

    SHA256

    c32da1fdb65c051d2b4b623cb56a405949a41394a9b55b3447a9e3a55ccaeb1d

    SHA512

    20a4d04b8d18deb94aa44b953e18fcefd7fad3db13a5f37eac6b21c9b2e4a5e1690ca13a9a8036567f55924b28d78e1af239782d94b37dae34e35c9e90bd79d9

    Download Submit

  • C:\Windows\SysWOW64\MSWINSCK.OCX
    Filesize

    121KB

    MD5

    e8a2190a9e8ee5e5d2e0b599bbf9dda6

    SHA1

    4e97bf9519c83835da9db309e61ec87ddf165167

    SHA256

    80ab0b86de58a657956b2a293bd9957f78e37e7383c86d6cd142208c153b6311

    SHA512

    57f8473eedaf7e8aad3b5bcbb16d373fd6aaec290c3230033fc50b5ec220e93520b8915c936e758bb19107429a49965516425350e012f8db0de6d4f6226b42ee

    Download Submit

  • C:\Windows\SysWOW64\aplib.dll
    Filesize

    12KB

    MD5

    35d174edd3c0bcfa9a32dce19e1abeb9

    SHA1

    c22638e64f8a5f34809811a2c286ae2f115028f8

    SHA256

    34194aa58d0eb70b513ea6a876a4f35ba6cc2f19c4fb6d408dd05580dcc74b04

    SHA512

    f807df3655e6dd0cea2412ae82aa7b3babe3862fa9eee5d38673ee30b26a528b9618e1a25d3a58ef1ff14be36a666fabd32968b5f4dc481539d2372b526c1ead

    Download Submit

  • memory/1380-22-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download