Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

39409cd656...18.exe

windows7-x64

10

39409cd656...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 08:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    39409cd656c0bc7567e2c8352dcc2236_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    39409cd656c0bc7567e2c8352dcc2236

  • SHA1

    0b4ded3b48affa28dfc075d3a56c6a8ed1ac9479

  • SHA256

    9f93f8f5e71266c7001be5bfa04830fc68f8a697b014d04058d1cf5417c5fbd7

  • SHA512

    d34208d2994a2a7314b2b0c16af693504658f3588bddbba4a31f5aaa75db37814b48584112d2a70e07a871852f7dbb1b90409eea6e5038781fdbc1aecbe3cd2c

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5V

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39409cd656c0bc7567e2c8352dcc2236_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\39409cd656c0bc7567e2c8352dcc2236_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4220
    • C:\Windows\SysWOW64\knnojupyyb.exe
      knnojupyyb.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Windows\SysWOW64\tstchmrd.exe
        C:\Windows\system32\tstchmrd.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2476
    • C:\Windows\SysWOW64\jpfiqzvvzvnconu.exe
      jpfiqzvvzvnconu.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1596
    • C:\Windows\SysWOW64\tstchmrd.exe
      tstchmrd.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2388
    • C:\Windows\SysWOW64\sckcmtpbzkpas.exe
      sckcmtpbzkpas.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2108
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    321b3ab5c761e4eb107275d523f652e7

    SHA1

    31129311f7414b74e7402c83c3d9c7f35849110e

    SHA256

    3f54acb39ab897d800228c71f00969ea279146977ebdbb598c2ee835e038700d

    SHA512

    d9d7616cfecbc1f2d0a682b7c14bc571419e9627aaf2e634134e38a3f39d5640025f19718fc121fef8225a45ee72d0377b149b7d79a503ca7712ef6c0f181057

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    8c35d5b528908d6412f1a415d29c6894

    SHA1

    026bee0076a3c6d6ff34f82c6a711c857487957d

    SHA256

    edfb85ab751ee2acb68b2157242c1a162513e7cca7eeb2400f17e2d312cd1237

    SHA512

    58e438e12a3d4053ef58eb51fc07427853f1144375866ad3754280c2df0019ee34948f9141978f1b4e6555451fb844e78114f0a897440e098c3ea288924c0c60

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCD9486.tmp\iso690.xsl
    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    d986bb561d849f4cfd590581afe5e80d

    SHA1

    a4ab3434f351001e2337abeb2f60f44078660abb

    SHA256

    af28c5eb116f8cac5db26d045ebf978b7646eb914a0073439dde2ec5a61a4c25

    SHA512

    08c7623773f11a8dc7b48fb48145050c894296bbebe869912a840ebfa89e71567acf7da12d02bc8055dfb8286f93036d35dbb3633684302f71c20c84c7d4c66c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    a01657c306d45c73057bc45019e4e50f

    SHA1

    1cc365ba4e2cb765dd57ef31042c70f668310fdf

    SHA256

    0c86d12a0786727b76dc464b0ec25943827a1a8d849f1317220745d6cab14d7a

    SHA512

    5e8a08661bdedd5d9e9bfd6e1dc9e7abc61acce7cffaf8bf3e52069f36fc90455b6ba74217b233b2a9aa2105a1bb60b63a528c4da3b77aa0994e41b1fe082d95

    Download Submit

  • C:\Users\Admin\AppData\Roaming\SubmitReceive.doc.exe
    Filesize

    512KB

    MD5

    3453a6dcc488959be120fd1db79108ed

    SHA1

    a783049ac4414cb2a6272d37c239c9d3ce2a0986

    SHA256

    4bc1f0fe67bed7ac4f3fb593a26e6cef88b82ee2316ad9cac33d701153d82f2b

    SHA512

    b0d45790c80db5612bd5d9dcb0bf0cb49d120f26933786d838ca0979f60280a053fc94103f19eda039e0b1f488682ad94602cc6d57954fae8a32c28b55aa6b5c

    Download Submit

  • C:\Windows\SysWOW64\jpfiqzvvzvnconu.exe
    Filesize

    512KB

    MD5

    2ff38637a5baedf4bad386d346de1409

    SHA1

    a0311a4ef9ddfb0ab445b9d69d90e6201cd3b774

    SHA256

    52c94f2951af7e3be62be3371f70f1311d6abd5afd486ad9719300eed48e21dc

    SHA512

    0ff77f9598922e721c5b5587388ac9582de701f794ba9fe285ef627275fc216d25357bafebf1b0760ac50042b8aa3ddacc04fc4c741dd2f1526cc0ff8e66309e

    Download Submit

  • C:\Windows\SysWOW64\knnojupyyb.exe
    Filesize

    512KB

    MD5

    5a9654d8dd6b408c99cf8005d2807a2f

    SHA1

    e48db38e29ab230a903bed6aa2d63495df6b3dd7

    SHA256

    b67eb953b4d7fbabf9c5e8eb0ebefe4aa4f82932faceeea831fc30dc92be0f97

    SHA512

    6cb8792353720f416b210dc7e37def78a295216418ee019abefb24116220930c22f963119d694cc88139b92d1bc108619cd1e3626526279283e51b0ea26d6ff3

    Download Submit

  • C:\Windows\SysWOW64\sckcmtpbzkpas.exe
    Filesize

    512KB

    MD5

    8c638643752be996f76d8c6efe4fdfb9

    SHA1

    31520a88bf484c9da4203f04859585d855c580bc

    SHA256

    e7e2d4cb634711d48bcaabfbfc546e4a665b38bcb437eb8b07529182181a627b

    SHA512

    c35b14cec80dac7c1c2ce5b2ce25f6c46949d79e97505ab6a272fcce41e0f785f3f0817ccf9139b9d762df5ce8c55dafcc432780e0955f4fa9f0b7ce3410b54f

    Download Submit

  • C:\Windows\SysWOW64\tstchmrd.exe
    Filesize

    512KB

    MD5

    fa6de4611c8e242343330a1ecc9a6925

    SHA1

    31c349bf1e1ca7464fcd6ad14e69c9509b71edcf

    SHA256

    6c3fc6906741e9b98bb7153cddb8e4c5d1bf8e1ad6b6ca14909f352f2583cbf2

    SHA512

    a2d86db8b034ed93b3396d27bcbf7ac143601780aaf45d355bbd12eb48dc03f55ad100bba0398e2d3c9d179cd0e792535b1e05713825986d565dbb8b77fa9c35

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    fd2abf9898c753a7cf79b3b381aaed4f

    SHA1

    ccf3d291c5c936d2b89d849a180114c886092170

    SHA256

    d1ad1bfba3686b4b2da6f3be76e02eacb8f2fe6d01bf1868e4f2f46da783c5cc

    SHA512

    05fad4e30a2ef1411287e9be0e84f73d1472f5aa3e0c210dc6ecd880553acc088c8057d6caf1e94dd08e4ba246df04d6f3920bee40592026fc496d9d2e25424e

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    03a7ccdd1c0ea4a4303e7b23d601e703

    SHA1

    8349ccceb483a4d945089325a2d4570891e3f63c

    SHA256

    8cb311553739af97a7f40fc764100d0a8b2b0c204f7ae5416970f3a92c0b0398

    SHA512

    bf7fd44cdc0e727963ab2f7bf360c09ed215eac61c964af8779ee13c90b253ceed844e0191463be01a0792adc0280820b8c3078c44db46d713233b3967166dd9

    Download Submit

  • memory/3908-39-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3908-38-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3908-36-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3908-37-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3908-40-0x00007FFA21920000-0x00007FFA21930000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3908-35-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3908-43-0x00007FFA21920000-0x00007FFA21930000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3908-615-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3908-616-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3908-618-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3908-617-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4220-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download