Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

08448a94a9...18.exe

windows7-x64

10

08448a94a9...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/04/2024, 17:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    08448a94a9c69ba7c6282108561036d4_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    08448a94a9c69ba7c6282108561036d4

  • SHA1

    5abda980f646bd60457869f9aef8ba1e1dde024c

  • SHA256

    a837b91aedefd4a62d7785a29b42ed3bfb6a9b1e18776e740a51905a21c8ce66

  • SHA512

    4addb089a8c7875b7c09bfa6d9b0a153a659d0b0213e6ab69e11c92dbc61accc42b1c2606b0d1de2abac62e82c23643adea8abe664d6f768ffa8fa585a8d4921

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08448a94a9c69ba7c6282108561036d4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\08448a94a9c69ba7c6282108561036d4_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Windows\SysWOW64\gifxthfglz.exe
      gifxthfglz.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4408
      • C:\Windows\SysWOW64\ngzdvsvq.exe
        C:\Windows\system32\ngzdvsvq.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5060
    • C:\Windows\SysWOW64\dvrhpfdpvvxxmsg.exe
      dvrhpfdpvvxxmsg.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3560
    • C:\Windows\SysWOW64\ngzdvsvq.exe
      ngzdvsvq.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1704
    • C:\Windows\SysWOW64\oborpfcsumaok.exe
      oborpfcsumaok.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2720
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    08f46a4ecd5869ec34dee86623dc71da

    SHA1

    d88f263dbfa2562467514065bbb89e2c33e568fd

    SHA256

    7f0a60574f75f0d54f2bbe178c5e8dd840aa1896d1d53ccc567a226382d27710

    SHA512

    9fd67a820dd8a73064873b1857974c5d0731a4762ec02ad0ec2f844d1beee5ff40493e5f1ff4683bc8d99e19dbfb4bb4e3c3e4bf6bd8ebbbcf483854daa62431

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\72N1I87NHUTNNBQ2WSG0.temp
    Filesize

    3KB

    MD5

    ed1336044edb18a10d4cd5417653e355

    SHA1

    af0b808150ceada6c95a73b220b92f5b75e5f74b

    SHA256

    9b32bc5565917eae57c711adad26059df5fc440c204a9b154de5a407055e606d

    SHA512

    9da9c7ae196659bf4a1d633a1558fd163bf5775049a4a009916529a37ecaa91377bce945bbdafbdfc539d7eab72351b9a74cbc47190222adcc21d116a83a0378

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    ae31b8b223ce119deb54d271daa42015

    SHA1

    a3eeea9c4de96eaecb7207730d9fda18384059dc

    SHA256

    16976527b3902b563170523c97fa7ae36f881d684d4fad5da5511817a7e1bd4f

    SHA512

    5c762c3c9bf8ad2599ed5faca39d866b81f40087bbbac7cb11962492076c09fa94f3c366a009b9fc975fb40a9900220f2ce5854f8ffb8bb4bff3a2a60c5b50d3

    Download Submit

  • C:\Windows\SysWOW64\dvrhpfdpvvxxmsg.exe
    Filesize

    512KB

    MD5

    6f5fe6d662e14febf5b92037de263b1e

    SHA1

    eeec611051d14be3147557b4c00dfbeab9ee6f67

    SHA256

    1587e961ed328c6c4c2e686584afdd8b09c49bc3e173f9810e257ad97cf22804

    SHA512

    bb86b4508eb20aa6bb53d0d44395d0842eb635fa11f3f6bf115658f8afa9cd9554d980adcaf61305e50190671d17c1ecc6c8431200bca02deee1ad9c83b73e93

    Download Submit

  • C:\Windows\SysWOW64\gifxthfglz.exe
    Filesize

    512KB

    MD5

    b7111af8ce6270cffe5fc488155f936c

    SHA1

    748fbf134e6de8cb0ae9cdd53de5229e9b263635

    SHA256

    26595197c77d48e2e3978b6673fcca9777d9ce04037ad15104ff64d865d87ce5

    SHA512

    fdb8457c1a4b8b45a4570837e23b1d1a731a4b4bf4ada2435634303428e7dea3d4279dd209f5849f88b8caaa53411ef4f06944a3e016e96a3f31a74769fe5ff6

    Download Submit

  • C:\Windows\SysWOW64\ngzdvsvq.exe
    Filesize

    512KB

    MD5

    68b3d20193f7d7a3a7d484bcf7475c9e

    SHA1

    82ad0ae251e8089bdc0f321cf31527309b0847b5

    SHA256

    7007e9a43a3c1309be6bf61e2599be91f73ee1252835cff4397bd83bce1d1dbb

    SHA512

    e5ea9c09b7e65f8b52b2f4553e6b88f0dc76198c5d5b5f5aa8ce62df2f8b9fc90c04c125af518e8e18f8cc9e6f292320212c95a7b860c7978acd79a07b7cd60d

    Download Submit

  • C:\Windows\SysWOW64\oborpfcsumaok.exe
    Filesize

    512KB

    MD5

    957f65f0333c2afec10825508fdd2261

    SHA1

    aa831bb6d407a3e01ffac2e426d657c72be221c4

    SHA256

    0070553e0b5a70adb1cea951da7160126b643d76549629fc117ecd6d55c2b0f1

    SHA512

    f540b903f5a251f816f3986a1c86026664580ad17abe89e2285d7b3cbcc2557ccbbb06d9727dc9e486efd88448ef163dfc36b774bab5b9714ffeb04ae1ec1af5

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    512cf2ea7d9f7f69e4026ed218a70705

    SHA1

    614232bd3b54a67f8b5a69c86e35cbb6494a9b24

    SHA256

    3ab7d933dfbe16200bb0407e47e34290849903ef2d9fde87c6b6513998e2fdbb

    SHA512

    498b7f019051bad49945d6ab029497654e1a019ce20d86605adf3511f353ff1375ed9f68929f6dd40906b8d813c1e9b9cc7afc268642d00cfe004475b565a46c

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    9b488de06051aaaecf6fb8cbfc9fe8e6

    SHA1

    dae1decb81fd5ed2ec8305b514e3f664bbea933a

    SHA256

    f355eab227fa92b18c101dda978fdc374bc9bca81f145213370b3412382236fd

    SHA512

    f50da4bd44f76e2b3bcbf3e6e629720fc712fb680ab10a0092bbd87b2f16173c75e0bdee1b71b8b550b8b319db178f48f10cac437f231761abefdec6af17bd6a

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    17046fadbc7b5f85121513d6f7054ea7

    SHA1

    119091f6e63b1b1712936e317ff6c4ce7f33f78c

    SHA256

    a5dbf5b56c638ac2fc61723b28ab5d15be0fabff80d14674fe6aa6bc784f2872

    SHA512

    4e525e3bb855505bc698a8ebb27f3f53e39ff6e394bdcb34fd1216fbca8a4daac437776ef0c301afaf9579e164ce7a4da6e0be435c357aa33883823af17fe303

    Download Submit

  • memory/1756-35-0x00007FFF062B0000-0x00007FFF062C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1756-38-0x00007FFF062B0000-0x00007FFF062C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1756-39-0x00007FFF062B0000-0x00007FFF062C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1756-36-0x00007FFF062B0000-0x00007FFF062C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1756-37-0x00007FFF062B0000-0x00007FFF062C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1756-43-0x00007FFF03950000-0x00007FFF03960000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1756-40-0x00007FFF03950000-0x00007FFF03960000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1756-109-0x00007FFF062B0000-0x00007FFF062C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1756-110-0x00007FFF062B0000-0x00007FFF062C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1756-108-0x00007FFF062B0000-0x00007FFF062C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1756-111-0x00007FFF062B0000-0x00007FFF062C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3768-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download