Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 01:49

General

  • Target

    3d70dc2238d6eb9717856bea4afe25b8_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    3d70dc2238d6eb9717856bea4afe25b8

  • SHA1

    3cfe04cb1ff8eab3ace24af3a381391bccb200eb

  • SHA256

    4842776370b2873c8d8b31302a23afe1deba3e9b44b4e7c1afcdf8da2da9ee1a

  • SHA512

    a4ffb764bd92ea6a0e5bd4397877c22c50f8c2d15357ac9ed40951533703b1ea90a5df42faa8b3046408e6986aae008f2a74157580f14c69a4ec1eeffba1072f

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6v:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5g

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d70dc2238d6eb9717856bea4afe25b8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3d70dc2238d6eb9717856bea4afe25b8_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Windows\SysWOW64\puaiocctgs.exe
      puaiocctgs.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1508
      • C:\Windows\SysWOW64\fbhenufe.exe
        C:\Windows\system32\fbhenufe.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3564
    • C:\Windows\SysWOW64\avzrxujqacyrozf.exe
      avzrxujqacyrozf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2424
    • C:\Windows\SysWOW64\fbhenufe.exe
      fbhenufe.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3432
    • C:\Windows\SysWOW64\filpfikumyexr.exe
      filpfikumyexr.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1932
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    512KB

    MD5

    702c6f1c1d4cda411cac1e71771b4905

    SHA1

    104d69a41ffa37f462376cfa36f25f7014075c2f

    SHA256

    17011b3235876972be23a932e6c7ca49e8a6634ec5148f1f6923e577c73f7369

    SHA512

    219e965f3efb1262d6032c39fae96c51b32f1bb135b3be62b01dd1bdfdaa29b32eedaeeef335b476768fdf7347b9ab869b2a9da9e07237546bcc25e166176e7c

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    512KB

    MD5

    f87aaf87e8339907fb59ba02304f12b5

    SHA1

    9aea41b73ffbf3865e7d521af5b4932e6ff37488

    SHA256

    cb98366e40670b87bfc31496cee22290bf334e506b44008e341e9afbdb57bc7a

    SHA512

    f18c62305b11b50afed17fda5a218c7ac50e0a4f051ca9f1a1156a139c5a33c5c7936f0e874c2150c2e52073705e9eb69d4a536a422b4332fbe9bc7750af3978

  • C:\Users\Admin\AppData\Local\Temp\TCD83FA.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    239B

    MD5

    7b89423871a8b3429c0db4483f1e3044

    SHA1

    d305d32237a5792a9b46be8dff420942db6c6def

    SHA256

    4e7c195e29839c46e13df90229a2c801432861f9b5f478cc7b439e0b21cf1217

    SHA512

    b6d83fb39d30af7c75a2569085438fb21f27a1d132646daeebeeae0d15498b4eeaae2c5cfd9f520b329086952803f1da2c932154c198d68a4d5022a34941acf9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    2080a30ad75a4eb9f773bd15e1308bac

    SHA1

    ca0434b8ef111f91efd7931840e133ec728b367f

    SHA256

    03dc9f2e934f1317480b0f1f5e6f08a1a81f37d65976f26fa011974e6df8b5ab

    SHA512

    a6904126e3ce4b3857b7cbbb9768ed041b0aac3946d242ce6e0393e412492554c520df1be0d38458bc8a6de964f05f3d4fb511707872c5bf21904d00244950c1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    7e4ec3e3d0f22a7d973a6da51c7b7e3b

    SHA1

    4f053f2f39bf1894416d28ebc813a41c277e1d0e

    SHA256

    a6bbf19dc78b74188420e10d6569dd77f4df2e92507848844719b24e854dd91e

    SHA512

    1dec20ae13b7dc9ae4c456d5f092b46d14d2db1d6355b35f5120e16c03ddc5ed0d4e5275718898e920e66467f48f55c71d9f2d36b081dd9b3492b4bbcebb348d

  • C:\Users\Admin\Desktop\GroupCompress.doc.exe

    Filesize

    512KB

    MD5

    a172ac4e8925f89aca78fe686fbdf8b0

    SHA1

    480baa3f0d6845373f99b087c90e809d1aee7832

    SHA256

    a81ab5d98e19d9859e914e3419ab62dcafddfcba2e5a1607261b648f04cee2ac

    SHA512

    bca75eba5f8ada30558b21cc5369b088eafc9a91b33fa944ca9b73961788d9975963c0fa91778f4ae108cab97f2124d0420cb948000801de4bfc2757bfe368f5

  • C:\Windows\SysWOW64\avzrxujqacyrozf.exe

    Filesize

    512KB

    MD5

    74bc3e4e2d449ac146e7945718a91d47

    SHA1

    b649e64c23edb207b63a266324bf94f4c95aabe2

    SHA256

    de12824bd2771e62b96b6f9d2a05bb86064aa31c40ff3875a871791d8070e36d

    SHA512

    25a311389ddda754535fb36876a841c0feea1c28f7d0c4c33be54a4a58c6a5923ac1893b6627f66f0aee46c2723523b3459da72463fa3d40b529528f6f8a73e1

  • C:\Windows\SysWOW64\fbhenufe.exe

    Filesize

    512KB

    MD5

    bae5df7c7ea057d18523b9e09bf5afe9

    SHA1

    dbd630714f2720ea5759523aea4214d5e1dc210d

    SHA256

    b0a0c34a9aeac5e3a141fe9dcb1ab39c3cd8a686a57e9d8c0f301eec648e0141

    SHA512

    c16ebc29fd899ea12d31222a744b91f3d79cbbcc5b66de486e38a16db345ce747ee4976a4a02b2caef1f5c2acd2e0cf21fe482443a55fa5baf5c2158dbe008ae

  • C:\Windows\SysWOW64\filpfikumyexr.exe

    Filesize

    512KB

    MD5

    654ecdffbdb73f618f83834e8941618a

    SHA1

    345c29bde7bc1c4b5cbf0be8bd91862328910e84

    SHA256

    93945742a985ff2bf8cde4f76cb42776897176cfd50791a22a2a0c55c7c93c80

    SHA512

    8823a9b39c23a867308b3b5e03b02f79a43e154d8184d5f9d899e97c7cc9793ce30fc325ff4d7bc7ce24315c24c0d1536d86576f09792fad621d1efba77402a6

  • C:\Windows\SysWOW64\puaiocctgs.exe

    Filesize

    512KB

    MD5

    86215921b6e813a327207277a86d41fc

    SHA1

    a98a964673e3761dda595eea83a6db22a47fc52c

    SHA256

    2e74e0cf2ee5b4c265984895a93a2528c67c81fd6aac0b5d85ea259cc849a2e7

    SHA512

    b828723cae654da635316fbe6fb85f2fe3d5b98c436f66e6daf034004d4177c640f9d434374545ddc0658b9c66e39989d3b9c970bb206f2c89a732f167884d71

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    28da667214245fc0aa7c11a5fc3f213a

    SHA1

    f57a86e61d959c6ac69681d50452e66a35c87feb

    SHA256

    88c92c88f49fa7afbf5c9b3102bc6f3a81b3ef4699e5d7f011ec8cd51536b5ef

    SHA512

    db8694d79412b626f070e3929a908fdd3b363fdc3ccb2e2d566588cf45a4dc7dabb22556189b7653e0fe3230b11639bf0c079388cc10e04ce7f0d6eb70ba9fcf

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    7bd6110386042b0da0dbf47b8e86e265

    SHA1

    e7c2301f782bb784595120f144ff48c5fb68ba0a

    SHA256

    48499263ddbecee9580305f99f33d435f7661bc3008cf565b3b1832c5daed540

    SHA512

    274b8585ba79ec7230da15caeec75eda13ee910560836eaab998dec44cf2d6ca62ea0138e68c996b9a34c3728a5d35e4668fab179c39cdbd8c266eb7f52e7fe5

  • memory/3056-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

  • memory/3912-38-0x00007FF7F92D0000-0x00007FF7F92E0000-memory.dmp

    Filesize

    64KB

  • memory/3912-36-0x00007FF7F92D0000-0x00007FF7F92E0000-memory.dmp

    Filesize

    64KB

  • memory/3912-37-0x00007FF7F92D0000-0x00007FF7F92E0000-memory.dmp

    Filesize

    64KB

  • memory/3912-35-0x00007FF7F92D0000-0x00007FF7F92E0000-memory.dmp

    Filesize

    64KB

  • memory/3912-40-0x00007FF7F6D30000-0x00007FF7F6D40000-memory.dmp

    Filesize

    64KB

  • memory/3912-41-0x00007FF7F6D30000-0x00007FF7F6D40000-memory.dmp

    Filesize

    64KB

  • memory/3912-39-0x00007FF7F92D0000-0x00007FF7F92E0000-memory.dmp

    Filesize

    64KB

  • memory/3912-596-0x00007FF7F92D0000-0x00007FF7F92E0000-memory.dmp

    Filesize

    64KB

  • memory/3912-597-0x00007FF7F92D0000-0x00007FF7F92E0000-memory.dmp

    Filesize

    64KB

  • memory/3912-599-0x00007FF7F92D0000-0x00007FF7F92E0000-memory.dmp

    Filesize

    64KB

  • memory/3912-598-0x00007FF7F92D0000-0x00007FF7F92E0000-memory.dmp

    Filesize

    64KB