Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2f82a626e1...18.exe

windows7-x64

7

2f82a626e1...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ch.dll

windows7-x64

1

$PLUGINSDI...ch.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$_64_/$R2.dll

windows7-x64

3

$_64_/$R2.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 14:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe

  • Size

    28.8MB

  • MD5

    2f82a626e189e3ee203c23954586cba9

  • SHA1

    e8e42be1a2d64cfc02f1890547c0ca1595c59764

  • SHA256

    c789f3686074617e1c909dfa6f93f472e494833c254a2eadb5ba948096412ce7

  • SHA512

    3ec51ff75869c772431499d989ff7dd34cc70b9d1f56e41f5ca2d8be33ab0a2e5d3a536cb78e59f272977084a2a3a4f411a8b4bf0c2fd59c05d010b681748eb8

  • SSDEEP

    786432:0gzzJZO1TCJVJwpHPeYJzYcUdMKgIr7ldmCExS5vzE:PpZETCpKHmYVGdMKgIrholU5vg

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 22 IoCs
  • Checks for any installed AV software in registry 1 TTPs 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Checks for any installed AV software in registry
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Users\Admin\AppData\Local\Temp\nst37BB.tmp\kupdata.exe
      -send 0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Kingsoft\KIS\User.DAT
    Filesize

    60B

    MD5

    965d870d1b35c3648cb243592e8e3f8b

    SHA1

    050e5f47495e99bef2a98becb3e8dbcb1c1dbc0d

    SHA256

    e05df189513037006137c62a50e9a8d66b1689ced723b31b3f96cb07fbc3d0e5

    SHA512

    bceb9f3d12771eae98b21d00eb7040d460d0719c84bb595a92c7e54ce27d9e8d70f77eade242969ff7f0b4d122ae6e787599c815f114c13018fa09d029803340

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nst37BB.tmp\InstallOptionsEx.dll
    Filesize

    109KB

    MD5

    d61e2f21de83247c39675feb9cdc5720

    SHA1

    d63905ab25a9509b4fe75b4df84cc2b09d5ae50d

    SHA256

    74db23fb889cafe045e39322884aeaf2e3f3e46d43c77d6907b8671abc23784f

    SHA512

    babd751f17f75187f66c85e4e4febb311a6ebc1e721cbd12b946b9887a907296e9f087c7ceae55628f9e6817697c3ef8858ec01f22a23abf3b3b1f26755fd294

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nst37BB.tmp\System.dll
    Filesize

    11KB

    MD5

    00a0194c20ee912257df53bfe258ee4a

    SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

    SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nst37BB.tmp\UserInfo.dll
    Filesize

    4KB

    MD5

    1e8e11f465afdabe97f529705786b368

    SHA1

    ea42bed65df6618c5f5648567d81f3935e70a2a0

    SHA256

    7d099352c82612ab27ddfd7310c1aa049b58128fb04ea6ea55816a40a6f6487b

    SHA512

    16566a8c1738e26962139aae893629098dc759e4ac87df3e8eb9819df4e0e422421836bb1e4240377e00fb2f4408ce40f40eee413d0f6dd2f3a4e27a52d49a0b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nst37BB.tmp\clearlist.xml
    Filesize

    13KB

    MD5

    daa061911d43376beb0e07d9fe8ff479

    SHA1

    572764a406b4c720e0dec25ea65b0ff29407eb2e

    SHA256

    30565af84172cf3d288c541a0cbbcbe60afc10322fb21cdd1fa8b0b5a2be82b3

    SHA512

    79e276644f9d69fe5dcf4260df9e24b5ef067e2940ce1831fad03bf0d9f0cd0ccbb5ea6e1e90ac2397f5fa1368fdf1dd0da52c5b38952b6d2bdc4ee82c7509ef

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nst37BB.tmp\iowelcome.ini
    Filesize

    812B

    MD5

    1ec99e1f30e8c6bfb4d3101a5491987c

    SHA1

    e069dd534175e0ad160b906ef8a494a3557b3414

    SHA256

    5391551bb324b2debefe250c1961724abf2d0216735e7d8dec513587d2ce9e54

    SHA512

    56c28eadf7e50e4af8486eab0ffa15a0c5b1ceadcf1fa837c9c3bacc8fb3cf4009e36d5b7a2216002425ae0622ad186e93fca17438a49450a218382de8062e71

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nst37BB.tmp\kasearch.dll
    Filesize

    273KB

    MD5

    fa72134efe05fc7a2689e249f74c3f65

    SHA1

    f10c843b6cca133b7d7272ef8939a296c2b5162a

    SHA256

    e2ea47e381ceae1e9dfcbaef0c069c3eb66e6798efed79a98d117ea61043b2c6

    SHA512

    064b8e4cc09be97e0eed3444ef260c81cecd3c5a2aec8901247c4659326004444aeee347f7c5805417c6372fffcbf29a0d5fbe34de488e35e500bf53ac2e7cf2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nst37BB.tmp\kinfoc.dat
    Filesize

    2KB

    MD5

    2e2d040562e8089c2e2db0c217c48be3

    SHA1

    668ef4c4ea4e67144c1b546a5c9dfc18eaf009a3

    SHA256

    8ff27bd1428088ba0ca87be4a4a98b9adb311132efeadb173e8188159a80e406

    SHA512

    d32e0160f639162b2858b48dd4eaa7471ba48f084cf840743f72785c1b7bc9fb7bde5bd2322b83827b8b6eecfac7a9bf126720f02e35c29d76e29ae65e2f0e04

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nst37BB.tmp\kinfoc.dll
    Filesize

    557KB

    MD5

    e426dcc7d31263a8dc8ea653859206b7

    SHA1

    569c1cb69b1191c5473a9a64b78c8789e342f32c

    SHA256

    2c2297eb1654398e0cb57a7b4e6e66c7b41cefa1d85a3c9343c833314ab3ca49

    SHA512

    7101cba19635d7b7fe024d3e259cfbf01bc73c85eef8762b07ba4d14ced53d2504f6143b941f248532b102d521ce638cb8a21356bd459ea5de006f4ee9651367

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nst37BB.tmp\ksiext.dll
    Filesize

    1009KB

    MD5

    335327c9d1e299ade4b7362ef60749d8

    SHA1

    83d4c646292e4194f0264f8427f61a7a7dfc3d9c

    SHA256

    7e6d2edb22bd9e7e4e826e3a6cbf7379285cdcc46045c8e4375b469b8f677a47

    SHA512

    f4e8dc14f39fd32420b389a1dddb7344507d16b82d5e15ffc85edff6ccac088a68a05ac60858a5f7b6aa7b32b1c33b211523d0936dc133228a7833ced921e83e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nst37BB.tmp\kupdata.exe
    Filesize

    97KB

    MD5

    3a4301c60bd5666531f4243de6257289

    SHA1

    899a1b4f752162f71bbe12a30ec018a0d8785aa0

    SHA256

    7b82ec0e025fc2ae5d52a753daf354dc575149bb8884d905e868865eb52bda4f

    SHA512

    92ec498d5dc1188cebf38f9bcbc1e9d97993b12b967b41a0ff863385944110293068e66746bd4af910490c50c02e851b122ed63aa432a22717a55c85a9f6d8fd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nst37BB.tmp\log\setuphelper.log
    Filesize

    9KB

    MD5

    9b0cbe153f0e2bc98b07a9cf796df30a

    SHA1

    c3001ef2395476c952c6a16566cc614c85b5b13a

    SHA256

    70cf9588c30ef3f92eff1932b3ec814be490584bc2132142f870756aa8266cc0

    SHA512

    c9ec299ed7ea56c07c62b4f00c57fdfa5e4c222b41e8e0d8ad2380d087fb55be6f4d0dc3f629fcf66b841f5a9595b6a08609e62af6e2e004f9da20cfe14728a2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nst37BB.tmp\setuphelper.dll
    Filesize

    425KB

    MD5

    31cbf1d1fe67d0f2fb06a76c537d9895

    SHA1

    4ca1882d38ec6ee6008b696366b4c9bb244e28e0

    SHA256

    7e5ee55ee9c2e482a8d8dadb00665ca2f93db74e95fe40c294f8518247a5f5f5

    SHA512

    95d8490c41a743f357f84b8b2236f4d6049fa7445e76ddd48f3efdc0fbddb6cc8f4f9dfa288880910eee18529afb85aec190dff728db8c76654c7f6568c06c9a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp52D6.tmp
    Filesize

    46KB

    MD5

    71e75d6ac753c2a79bcb208692b6e767

    SHA1

    cb603d678cfc833f7d6f250c5085798e79f671f4

    SHA256

    8f44d90932504d979808ad9322ae22fcc5e72e898a2f864bfcdfd5d5c6082290

    SHA512

    7dac896f817d9e5056f1cb629c3ae9c19b75a12f6d9856a4593e1bbcad9b96116efbf3ac4f85f98d84d34df60c0054fee5f93c446ded348d87c5bbd14dac9bbb

    Download Submit

  • memory/4296-262-0x0000000004D00000-0x0000000004D45000-memory.dmp

    Filesize

    276KB

    Download

  • memory/4296-86-0x00000000049E0000-0x0000000004A4B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4296-94-0x0000000004A60000-0x0000000004AF0000-memory.dmp

    Filesize

    576KB

    Download

  • memory/4296-17-0x00000000049E0000-0x0000000004ADD000-memory.dmp

    Filesize

    1012KB

    Download

  • memory/4296-2319-0x0000000007FB0000-0x0000000007FD0000-memory.dmp

    Filesize

    128KB

    Download