Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

7bfa563640...18.exe

windows7-x64

10

7bfa563640...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 06:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    7bfa56364080e9b1f129d572f3f3a1d2

  • SHA1

    8df9637881bb587a37c9ad30a24767f8f716d090

  • SHA256

    de4f53cfe8c5bdc09b9869a231e520ccd28ec4440ddbfa43dddebbc79f08e6c2

  • SHA512

    c73bc82a1bf88624d3e15fac7fbbda5a99aa6b06bf7d3cb7e3f422639b25611bfc70c1b2af22b6591c9811cef6ba07303f50522625616fe60620a0f14fb184de

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6P:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5g

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\SysWOW64\bltibgrmlr.exe
      bltibgrmlr.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\Windows\SysWOW64\manszjae.exe
        C:\Windows\system32\manszjae.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2636
    • C:\Windows\SysWOW64\lnkikejvkggthqg.exe
      lnkikejvkggthqg.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2736
    • C:\Windows\SysWOW64\manszjae.exe
      manszjae.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2592
    • C:\Windows\SysWOW64\uftbdphkenkav.exe
      uftbdphkenkav.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2584
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2504
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:484

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      70fa0e5992393a8c30d14e0f02bffa6c

      SHA1

      9f51e9bacd78e44694f4b554145327dcfc69fbb0

      SHA256

      ef507afb4f368f145cde6a954b4314b700f947824c93f3028c6dfbf13e9e7c9f

      SHA512

      0ad42af779a53ad0feb618c3e37c8801707cac4911c94511a591d6fcaf212aaeae58200ffc416b36c19abcc6a6e5d2d455b37f9050886238e8f45bca09aae9eb

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
      Filesize

      52B

      MD5

      34caeb4bb386ce3a9df68246d0c531ef

      SHA1

      64a38fc1db78d04f6a891f8477e5874110c4c6e7

      SHA256

      4f46f54737287c77c30202e9129a65294bae6df0cd43d16b10a15025bdc601a6

      SHA512

      229c7b274aa2f7df434ce8e211776797cee19480d9739e6e3adf068edfb4af8536eb76f3b156be2e5adcb0a71a8c0e854e7f25b9bfbd89e5f96eafa35ec829aa

      Download Submit

    • C:\Users\Admin\Documents\PopTest.doc.exe
      Filesize

      512KB

      MD5

      d6fc68e4f4c80fe81b046bc85ca712f7

      SHA1

      f1b2d3562af3d2dde122c1009afcddc4b2b22fb8

      SHA256

      da0c7736366e2c5493395c09f3cc38ca317098d3dfc7857be36cce099d47f521

      SHA512

      01d83ab49cb847fcbc5324c093c145ef4572b8a85ba578e3a1e07a7a0e65bcea9243c475a906b80f19d82811cd4ea4ba09d87d9a7fbf0d20ac8f70a54601f4b5

      Download Submit

    • C:\Windows\SysWOW64\manszjae.exe
      Filesize

      512KB

      MD5

      5dec22fa2803324c6636b55c1a464481

      SHA1

      8b3d041720c7d24c2a6630e9aa8ae56f7f42c3c2

      SHA256

      a69ac2da5a4f584d7507225fe5d0b2dfe469e58d8a945560695e54df746339c7

      SHA512

      1ba70c0871543699de2369ec46b9297c5f90e14d02eb9ddab2d2e7778b7dd8b79f8fcdc1e4f3d9668ff95e5e34badfc1d5a6c17a0ece8e10c4a39eeff058e38c

      Download Submit

    • C:\Windows\SysWOW64\uftbdphkenkav.exe
      Filesize

      512KB

      MD5

      c77da5f4b3b323cbe232ea730f49fdae

      SHA1

      3fdb1ef42f0f83b96046c7d9377e2a43a3129484

      SHA256

      19b59e711200e2d8d69cf90f838a4dd4ac4f1c4cbcba8e0fbd34d01f93b2c766

      SHA512

      52b917205861d0174b006c72a373afe0a6e6c0ddf7ea7f9cb43e8ce439377985f6272efc792fb3f0439d778fa20cc61a9cf3bf94f87c23b2fc2d498ca7249cab

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\bltibgrmlr.exe
      Filesize

      512KB

      MD5

      8f4677254cbcb27e05671b846350cd41

      SHA1

      aa4aac2cbaeb4e62994d65151b7331c7ace93895

      SHA256

      9cc125e1cd3ea13c19e7eec3d385910eb41c5800f06e75899fad0cb3c4352e65

      SHA512

      2e9a81361fbdbece38f755f28d7aadfd4334d4594f2588fb6deb2f4e6e9313d737011353cb6a443a245bc2f338a0e2e98ca40f0cebc0523359e70d50feea334f

      Download Submit

    • \Windows\SysWOW64\lnkikejvkggthqg.exe
      Filesize

      512KB

      MD5

      858550055d75c59969266652a31ee98b

      SHA1

      a5a8cba6c958f5368091fb482c4683e6310ec4fa

      SHA256

      f15278edc1b5a8708f36e083700a77cfc8bb206e504839011748cd5b5fc522ea

      SHA512

      d491a7b2922db0216b8376ef5c1a408dc908014d4059871f4fae445989a3d51e3616392044328813fcf7689bd88391c735f86d71093ae614980fc7de46b4846b

      Download Submit

    • memory/484-85-0x0000000003A20000-0x0000000003A30000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2104-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2484-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download