Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

16e28a3d1a...18.exe

windows7-x64

8

16e28a3d1a...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    128s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2024, 08:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe

  • Size

    4.4MB

  • MD5

    16e28a3d1acd75a0c572ecca2d700091

  • SHA1

    813a8a568bc0f70f0445984d9477d5dcdb691ac9

  • SHA256

    104075a9d32f48cf8f38bf1d4f167677956353025742cf44ea1333277510a08b

  • SHA512

    fc241a6f6d6c33a81ec655b3b5b6fe3d22e92e69dfa163438a522a6cd35415e1d37ba50a0c0537f8a93dedae56f7515cff3cfab96e1da8f6861303bd085397d8

  • SSDEEP

    98304:wzz+XKNcftkb40z9LaIjA9yHtynfDFe2uNgto5ibfdPWjm:w+S4jEyfDSYR2m

Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Maps connected drives based on registry 3 TTPs 1 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 39 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe"
    1⤵
    • Maps connected drives based on registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Windows\System32\schtasks.exe
      C:\Windows\System32\schtasks.exe /create /tn SpyHunter4Startup /rl highest /sc ONLOGON /tr "\"C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe\" /s" /f
      2⤵
      • Creates scheduled task(s)
      PID:3812
    • C:\Users\Admin\AppData\Local\Temp\EsgInstallerx64Stub.exe
      C:\Users\Admin\AppData\Local\Temp\EsgInstallerx64Stub.exe -inf DefaultInstall -if "C:\Program Files\Enigma Software Group\SpyHunter\EsgScanner.inf" -wait -1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Windows\System32\rundll32.exe
        "C:\Windows\System32\rundll32.exe" setupapi,InstallHinfSection DefaultInstall 132 C:\Program Files\Enigma Software Group\SpyHunter\EsgScanner.inf
        3⤵
        • Drops file in Drivers directory
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3412
        • C:\Windows\system32\runonce.exe
          "C:\Windows\system32\runonce.exe" -r
          4⤵
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:1640
          • C:\Windows\System32\grpconv.exe
            "C:\Windows\System32\grpconv.exe" -o
            5⤵
              PID:4624
      • C:\Windows\System32\sc.exe
        C:\Windows\System32\sc.exe create "SpyHunter 4 Service" binPath= "\"C:\Program Files\Enigma Software Group\SpyHunter\Sh4Service.exe\"" DisplayName= "SpyHunter4 Service" start= auto
        2⤵
        • Launches sc.exe
        PID:2268
      • C:\Users\Admin\AppData\Local\Temp\EsgInstallerDelay_1e71bbf294f07658c4881bd2b4e979dc_0.exe
        C:\Users\Admin\AppData\Local\Temp\EsgInstallerDelay_1e71bbf294f07658c4881bd2b4e979dc_0.exe -exec CV4P+xygvPOFO/dCO2afl9/Gv0h/j7gpYm2O1knUWcBdGKgfSuDvRodBjRP7CVV4wTwHsG7aBWO7Qbn/v2X3Pg== -args yxLBkkwK+tN/g/lTFU7okMk01a8t+L6jhnEHJZP5MeU= -wait 300
        2⤵
        • Executes dropped EXE
        PID:4380

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Enigma Software Group\SpyHunter\EsgScanner.inf
      Filesize

      1KB

      MD5

      b502b976d57fe85434ac93528ac27b05

      SHA1

      1bdf21314ff4d161e608067acbb6407e33c2edc3

      SHA256

      3b83918e5c5f069885b5be95d89fad6d964aec68a70f8717bcbee88f7fca177e

      SHA512

      e1bb2a1d236fd895dc0966c08a664fccf4c5794d7f07ea9b6fa77b0ad7a0bb42e1eb43aa0ba07f3b63f789c1939fa15266b3b830726924c4f39fee2fd2b9f891

      Download Submit

    • C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe
      Filesize

      9.6MB

      MD5

      3762cdf8e0c1429c47028679dd2bbf89

      SHA1

      fc6b12ddda4e52f21c65ca748dd26e01be193e98

      SHA256

      e8a33d753a0804a335f1ef49588c7e5433f18f4926464a00bea27ce9344c6c3b

      SHA512

      9a9ceb887139610202d440926ad4a974508936d3d7a81e6ab6936b3582aced806b76e0fa2e39e243379254a1f236fda2dd5d0f144e4516d4d74371be30ccbe7b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\EsgInstallerDelay_1e71bbf294f07658c4881bd2b4e979dc_0.exe
      Filesize

      215KB

      MD5

      19b67ab7591a2dc79ccf9ec2160e3c4c

      SHA1

      5f6716a8772fc8b36d37f1829031edd9062f36a2

      SHA256

      a59ad588e91e7d40ad57af3aa41d32341c1c6cf2e2eff614802f103b67941595

      SHA512

      75795c10aa25b0fb9c2a07fec4e73a457b0956aef95587303b49ed0a9422f1c22637fc80439adc1798fd9a728107fc6854634cfd0d6e5ea98309cbf8ad6a806c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\EsgInstallerx64Stub.exe
      Filesize

      156KB

      MD5

      3aa22e5e51d9a1d0bf0975d08f9f0c0d

      SHA1

      e8af46664bb81ccae93a2fa65889f820c76d016a

      SHA256

      e905047af9613f9122ad0585c5845dd87a375616eb13ebb61b7f5ac5b6503618

      SHA512

      a8c5ec9512ceb4c9a34656366ad284558cf6382bcaa792a73dc41687e6aa9c88d23296d768fa7d0918bdd280ba463e3b031b80cf71cb57d6acb9fab8266a5f4b

      Download Submit

    • C:\Windows\System32\drivers\SET98C5.tmp
      Filesize

      22KB

      MD5

      3b32caa07d672f8a2e0df5cb3a873f45

      SHA1

      d61c97fe35649c01280291dda96e6b0df74da492

      SHA256

      09687e30fa5779c3593769d66caebed95c932746edd6e83dabe3dcfd126ab5ec

      SHA512

      1ac0e91eff28a7587acc2ab73cd8b513260acdc2e53b9531f4cabb2b92a1d487ed42edb24c5c6319b2e467c98ccb8697d51653c4cadcb27a256249e2bb48aace

      Download Submit

    • memory/3664-0-0x0000000001530000-0x0000000001531000-memory.dmp

      Filesize

      4KB

      Download