Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/04/2024, 19:24

General

  • Target

    f42a04d9eab7a9c120091e4970ae5939_JaffaCakes118.exe

  • Size

    479KB

  • MD5

    f42a04d9eab7a9c120091e4970ae5939

  • SHA1

    7cfaabe722a3c99a334a11476b44f75b0d178f18

  • SHA256

    1a055fcaf53dbd5db4000322faeadcbf57050b8efe1767ce672ccf69cc59dbe7

  • SHA512

    0e18d4c1bdc1fb8866dab60477b10056da635b620096dddc244ea3a456392486e0f52626255c0b3d519f0c4bbd9960374964d009d100ffee9e6bc7de1a9c124e

  • SSDEEP

    12288:p7/AYXrP8QvVy1qbekyKM5lOQzMSFvpDEbZ:JZfCKeTFRDU

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 10 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 4 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f42a04d9eab7a9c120091e4970ae5939_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f42a04d9eab7a9c120091e4970ae5939_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Windows\SysWOW64\cmd.exe
      "cmd"
      2⤵
      • NTFS ADS
      PID:2412
    • C:\Users\Admin\AppData\Local\Temp\f42a04d9eab7a9c120091e4970ae5939_JaffaCakes118.exe
      f42a04d9eab7a9c120091e4970ae5939_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3460
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4556
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:4640
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\f42a04d9eab7a9c120091e4970ae5939_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f42a04d9eab7a9c120091e4970ae5939_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1496
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\f42a04d9eab7a9c120091e4970ae5939_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f42a04d9eab7a9c120091e4970ae5939_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:1708
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3296
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:4272
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\server.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\server.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4168
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\server.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\server.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:1328
    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\taskhostt.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\taskhostt.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpnetvk.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpnetvk.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1440
        • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpnetvk.exe
          wmpnetvk.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1404
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2788

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\taskhostt.exe

      Filesize

      9KB

      MD5

      abd2e50ed727642c0aa0a911e8d45064

      SHA1

      a53879e8636d04957268223a4395422a70f8d941

      SHA256

      152d5f38b4d8de3aec4c1a2dcce0ce7308f88d07e02f17a4ac541552fb9a82ae

      SHA512

      5eacbe37fd41879f1e21a5aa3a6425f07af3dd9e7a941f00bd2533f4cbe988f0460a06fe4d021c2475dc601605fb18caad50758642223b0f18397c559b1e39d7

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpnetvk.exe

      Filesize

      479KB

      MD5

      f42a04d9eab7a9c120091e4970ae5939

      SHA1

      7cfaabe722a3c99a334a11476b44f75b0d178f18

      SHA256

      1a055fcaf53dbd5db4000322faeadcbf57050b8efe1767ce672ccf69cc59dbe7

      SHA512

      0e18d4c1bdc1fb8866dab60477b10056da635b620096dddc244ea3a456392486e0f52626255c0b3d519f0c4bbd9960374964d009d100ffee9e6bc7de1a9c124e

    • C:\Users\Admin\AppData\Roaming\server.exe

      Filesize

      479KB

      MD5

      5800d77b7fa6db7f1aecdca40237762c

      SHA1

      5366c565ab1f533190725b2a3b2e4ec40635d77d

      SHA256

      e8c0a05fbc229033b977396a972e3158f69c57e340f8593613f5d14619953603

      SHA512

      6415232f309879b596c4d2919e61b67b418a7b12bcd0bd57f3e0762c385cd5ee036c82b8bed603f835890c83980267e35eae0107117406a148f3e4326728e374

    • memory/1440-49-0x0000000001380000-0x0000000001390000-memory.dmp

      Filesize

      64KB

    • memory/1440-48-0x0000000074FC0000-0x0000000075571000-memory.dmp

      Filesize

      5.7MB

    • memory/1440-35-0x0000000074FC0000-0x0000000075571000-memory.dmp

      Filesize

      5.7MB

    • memory/1440-36-0x0000000074FC0000-0x0000000075571000-memory.dmp

      Filesize

      5.7MB

    • memory/2316-46-0x0000000074FC0000-0x0000000075571000-memory.dmp

      Filesize

      5.7MB

    • memory/2316-31-0x0000000074FC0000-0x0000000075571000-memory.dmp

      Filesize

      5.7MB

    • memory/2316-32-0x0000000000B80000-0x0000000000B90000-memory.dmp

      Filesize

      64KB

    • memory/2316-33-0x0000000074FC0000-0x0000000075571000-memory.dmp

      Filesize

      5.7MB

    • memory/2316-47-0x0000000000B80000-0x0000000000B90000-memory.dmp

      Filesize

      64KB

    • memory/3460-11-0x0000000000400000-0x0000000000470000-memory.dmp

      Filesize

      448KB

    • memory/3460-13-0x0000000000400000-0x0000000000470000-memory.dmp

      Filesize

      448KB

    • memory/4888-37-0x0000000074FC0000-0x0000000075571000-memory.dmp

      Filesize

      5.7MB

    • memory/4888-45-0x00000000015A0000-0x00000000015B0000-memory.dmp

      Filesize

      64KB

    • memory/4888-0-0x0000000074FC0000-0x0000000075571000-memory.dmp

      Filesize

      5.7MB

    • memory/4888-2-0x00000000015A0000-0x00000000015B0000-memory.dmp

      Filesize

      64KB

    • memory/4888-1-0x0000000074FC0000-0x0000000075571000-memory.dmp

      Filesize

      5.7MB