Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    124s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 18:08

General

  • Target

    35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe

  • Size

    25.5MB

  • MD5

    35e10c53232112b1193880e5b3ef36bc

  • SHA1

    d31c06051210c825c394da2842031b845f94f609

  • SHA256

    c37ac379f7614de0382c60dee8470067c15397a0679cff1f6e4b7f6b40f029b6

  • SHA512

    864e3dfb840b3ea9ff3c0478d97da3b7e98b587fdc75252d561f009b0e121491855624b7e46de736dba8f1ac02c56cf610d84d614f83407557a4b71538a54319

  • SSDEEP

    393216:gg+IWYDv9FYF3+x/h/13Bs+VYVY03ssoV+/Z/Zs+dEJxiTP/bciziKTDxb/rKXIE:H+7F3M/9Njf2tdEmUizB/rKYSoorz

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 20 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    PID:212
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4604,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:8
    1⤵
      PID:2328

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\DefaultGrLauncher.ini

      Filesize

      117B

      MD5

      64418a9ce6c5f650bf92114db26c6f25

      SHA1

      eb380495eaefc1a8878bb760be7a7a5e83b2b972

      SHA256

      80e78ae6f5f2cca5e6427edcbc779a7b422bb9f79ac63525bc7906fb17cb8288

      SHA512

      cff660766c8daf927dac9fd9210849d72040f418d83085b0a75a08eb40ae1077e412e1571e1a747773d3471719b9e8d055f486ed2e9e0205e620e7a487759e98

    • C:\Users\Admin\AppData\Local\Temp\NSISPromotionEx.dll

      Filesize

      1.8MB

      MD5

      9e76a9d52f45845280024561eb0583d2

      SHA1

      89a92563bfcb784ce0a17b3ba02e336f59dfb6b8

      SHA256

      c10670e98eda82fe0984a02c88949ac1be96ca466d6d424a77ea5b67118e8d4d

      SHA512

      9dab31a7dd32c01ca6d6ae38f38cfe8aa84a338b3cd4d540e308e246ec09f390a00bfc698a0b739951df66356a74de925b7e2c9be22c0e06ad2dd1b891451715

    • C:\Users\Admin\AppData\Local\Temp\nsmE4C4.tmp\Dialer.dll

      Filesize

      3KB

      MD5

      cfe0ac822ed2c3598de87fe3931c92a0

      SHA1

      0c603bdf81abe835621f29acd5ab2a67e670e762

      SHA256

      df2f6d3c9de979dbde3aa3cf0633fc8cd3215cfba5b5fc02f94338ac16cc2cac

      SHA512

      cacbe97b03cd2037fe28ae928b292a1558fc88ac2dc0a27e859efb413529e47f099b429e41202151f4f52fabf33c67911472edbf41132df1a7e6d1f0eac03b3f

    • C:\Users\Admin\AppData\Local\Temp\nsmE4C4.tmp\INetC.dll

      Filesize

      25KB

      MD5

      bcf627d0db38c8e772e292b509a625de

      SHA1

      8ee208ff94930571b176ef92dba1c5ef5dd9c415

      SHA256

      6bccf372e490c49a3850e4f326c6a988e08991bbfe6e89b9c35d3efe29d304c4

      SHA512

      234c83b48e2f6e650a955cadcb227345f38392fc05101d21611c576307595a99e2e357be7ab6dc7d6d0a0deef501bc29dbca12907821cae9d9e2c8f17e21f7c1

    • C:\Users\Admin\AppData\Local\Temp\nsmE4C4.tmp\LangDLL.dll

      Filesize

      5KB

      MD5

      0c44f21d4afc81cc99fac7cc35e4503a

      SHA1

      3d0d5c684df99a46510c0e2c0020163a9d11c08d

      SHA256

      8dc2be6679497994e3ddc97bc7bc1ce2b3c17ef3528b03ded6696ef198a11d10

      SHA512

      4e4bd35d6aa21cecbfe7a93a2ee7db8ee78ca710a4193dfe240d1067afbe10f61db332c1c85f6cc3ba404d895a959742401b615ef8ff5bd9028254c4a43a0923

    • C:\Users\Admin\AppData\Local\Temp\nsmE4C4.tmp\System.dll

      Filesize

      11KB

      MD5

      a4dd044bcd94e9b3370ccf095b31f896

      SHA1

      17c78201323ab2095bc53184aa8267c9187d5173

      SHA256

      2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

      SHA512

      87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

    • C:\Users\Admin\AppData\Local\Temp\nsmE4C4.tmp\UserInfo.dll

      Filesize

      4KB

      MD5

      b98f45a83c1d09132e1e4ada1387a6f8

      SHA1

      9f0a343ec5060b269d36fe1045cff14185f15d1b

      SHA256

      23661a4b1f3d6744fcdd1b2379e5e602e6cf6bd5950b2d19b844527b2f626e99

      SHA512

      cb446acd93c4dd79e81b920075a7055140b27d3e83b43ad899736a0d37e709974b27c5340a4b864e3b41714523dd4daee07b506a2c40b36f9b9d05fdd5cc2612

    • C:\Users\Admin\AppData\Local\Temp\nsmE4C4.tmp\ad.html

      Filesize

      191B

      MD5

      8464f87975aa647c253e5403534f228f

      SHA1

      0a1d2571a454b76ff43ade320631853650ba448d

      SHA256

      85af9fb1cd755893365f5b0eb6fdb37533084dd8fea0245a12a83a4c1fa69540

      SHA512

      d3a38b949eb81fa35fd7d3b9af65093fc70c53348d7f472bc2bb6a2af3fb9d0a45604965e06c13d365b82838f85d24bfd7bd5ced6832bd3b9572a2adf7845a4d

    • C:\Users\Admin\AppData\Local\Temp\nsmE4C4.tmp\advsplash.dll

      Filesize

      6KB

      MD5

      505c7c214c17ac801f5930abc57d38c3

      SHA1

      e9a17ed8182f92bf86babbd7ba8dd8770e8ff47e

      SHA256

      999ebf5ef6bf51828193deaf7697e6d22419e437c65e603bffa0bb2acc7f40c8

      SHA512

      30686f361db9d81c95912700af530529d4d89bf6b514a63ab5db6b20efc443b87aef44b598e45d33adee448ec1b6573ca035a1d20e11c78ea8253f1ecf5ebf38

    • C:\Users\Admin\AppData\Local\Temp\nsmE4C4.tmp\md5dll.dll

      Filesize

      6KB

      MD5

      7059f133ea2316b9e7e39094a52a8c34

      SHA1

      ee9f1487c8152d8c42fecf2efb8ed1db68395802

      SHA256

      32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f

      SHA512

      9115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51

    • C:\Users\Admin\AppData\Local\Temp\nsmE4C4.tmp\nsDialogs.dll

      Filesize

      9KB

      MD5

      0d45588070cf728359055f776af16ec4

      SHA1

      c4375ceb2883dee74632e81addbfa4e8b0c6d84a

      SHA256

      067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a

      SHA512

      751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415

    • C:\Users\Admin\AppData\Local\Temp\nsmE4C4.tmp\nsJSON.dll

      Filesize

      18KB

      MD5

      e89c7cd9336d61bb500ac3e581601878

      SHA1

      45b2563daa00ba1b747615c23c38ef04b95c5674

      SHA256

      431fc2ed27d0b7a1ce80de07989595effcc3ffb1dea1af6c0e178b53f6bd2f1e

      SHA512

      09485a354ac4ace6084cb6fcbd92eee8488074763c8443638f78e655e45e8aa0fe40a45d4ce0dff116ed3a4bb7bc4d7d845a6ccf0e0bf35533ce81626a8db06f

    • memory/212-27-0x0000000003CA0000-0x0000000003CAA000-memory.dmp

      Filesize

      40KB

    • memory/212-104-0x0000000003CA0000-0x0000000003CAA000-memory.dmp

      Filesize

      40KB

    • memory/212-103-0x0000000003CA0000-0x0000000003CAA000-memory.dmp

      Filesize

      40KB