Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

7f9d1ee58a...18.exe

windows7-x64

10

7f9d1ee58a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 05:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7f9d1ee58a41935047dd6e5127cf671f_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    7f9d1ee58a41935047dd6e5127cf671f

  • SHA1

    2a718220cf80fcd26ebd6ffdc81e81fa949e704b

  • SHA256

    076fbed368d515a4f27a373038975d3120d2c1b6548e2ff1d8a0b3c72338db1e

  • SHA512

    79df0a835b96c68a621bc0fe2ffe156a0e9c0d990d16687a579757b34934d8f59458bdc5197f0f4dd67c2e0817957d1f610ffc3214effbe0e2fe0b0bf78b8a02

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f9d1ee58a41935047dd6e5127cf671f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7f9d1ee58a41935047dd6e5127cf671f_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3216
    • C:\Windows\SysWOW64\usyumcwlwt.exe
      usyumcwlwt.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Windows\SysWOW64\axqajvgj.exe
        C:\Windows\system32\axqajvgj.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3180
    • C:\Windows\SysWOW64\fxlzdhxhywxxwlr.exe
      fxlzdhxhywxxwlr.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2368
    • C:\Windows\SysWOW64\axqajvgj.exe
      axqajvgj.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2428
    • C:\Windows\SysWOW64\hvaqccwlnpwdn.exe
      hvaqccwlnpwdn.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:464
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    a70b6d2e3da6ba16162cef79331090a4

    SHA1

    cffce86ba7c1e05068d932735416093840b61bd0

    SHA256

    cdb726a422e2e22e17fa69430a283355c777aab026455168eb575c3e99483527

    SHA512

    29c7854536bfb77a815e599ebb6d8077fa93a57d48f186688752f8777513d2a129a32441c40e1e7e5896d394f57839051bdc7ca38a2b0b1d0bbe2a5f42ef146d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCD9E87.tmp\iso690.xsl
    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    a55a1c333bb7907508b76fee9ee89479

    SHA1

    7f9135db321207856dadba78002e3bfe9a32af6a

    SHA256

    f43fd91e7a375bd4a029f73587d6e9ec88c8a29da1efec87aa3bd70c9fae42a1

    SHA512

    a5889a3b2d11948222f5207a0ef36f096f100921e936cfa1ef63e71a812ed18bd49c01e8ffb00ffad1afc254e17066d6641f3c0f7a930c6b64ea2b20bbda9645

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    94446d2dd012b9bb8e1a19ddaaeec373

    SHA1

    02361fc09409f60a57513611394288087bba6cb5

    SHA256

    eb87f58bbc2677df517c98ddbd6eaff29b996f7d0128f65f70515c9b2ee55a1d

    SHA512

    2b5e47e844f49f32e6d97fb7b7e2f18849de3cd447df2e54d266c5c5a62e7ecca546dfc71bee04661541202d5307fd12ceaf33ff795a32450247d0ebdada5066

    Download Submit

  • C:\Windows\SysWOW64\axqajvgj.exe
    Filesize

    512KB

    MD5

    87adcb50faa86961913a1be70fec0f86

    SHA1

    6ba6f7e3142afed5a020cf4258cbfc12e4e6187d

    SHA256

    839be0a3f168c732be3e7067c784e96d176987c775b1dbe568f84b2c22212b9f

    SHA512

    c0ea516208afe77c8bd24bffa61b5ac15925f5f4866c86e36d5fd9f03cb19e367032ad9e379d83d4f62073bb2c0f3162f4b92b7a86d43a8f89752efb1748bffd

    Download Submit

  • C:\Windows\SysWOW64\fxlzdhxhywxxwlr.exe
    Filesize

    512KB

    MD5

    6e71e96b1f7eb0906134f287d7d18542

    SHA1

    d215e647c7874b8bfb8bc41638c3fd118f3bfc86

    SHA256

    c6071a0f3ebfb5b4f2d9d78417567c91c9e81928f5ba42d897f4f00565b4ca12

    SHA512

    4ca895c9f8eb638860650a5f5f97c0866e2d9361f374fd056b46d29076d20b1737f70e1d533c4550e3abe6ecb0632af54a2559631974b08e706ad0678095065b

    Download Submit

  • C:\Windows\SysWOW64\hvaqccwlnpwdn.exe
    Filesize

    512KB

    MD5

    9d33fd23c5d55b01f97a6f4517e06630

    SHA1

    4dea4e4b21674dde9ef490f1cae561c6b5e13abd

    SHA256

    aff5c7248394c6b135700e5e6f9aa670b146389db0615ce8a9df178be262b8e3

    SHA512

    99b573a8f551afb4dd6dc9e25692dd72325d6f07f18da08de2facc7c1fc13bbc43bfaca3fbe9ec8f28a7dbd4e0431b0b403cf053bc5f65be99528fc40c480dcf

    Download Submit

  • C:\Windows\SysWOW64\usyumcwlwt.exe
    Filesize

    512KB

    MD5

    5f36340cd97bf3748d2613e06eb21de1

    SHA1

    af45f85174e8a2d535797ea48b51b0220351d737

    SHA256

    81ffb22c5893399eef6e4eb324c9aacc83b2f8fcc1d503ec44a8131172f08fa7

    SHA512

    47d09ee91386671c84e64df20554335858977d5723726013a33a23482bfd37c10fdae88aa8c58c76c8df518f5b855adfe0bea8b4c5f06d1a55125798b6669c89

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    77505a2266bb4d5f183e287b29ac7156

    SHA1

    9e2d2f672c79ff220972e8ad5cc3aa8a02a46a11

    SHA256

    a1c8a216c02c803357eb240619f2b085994bb4044802db73870d08df14143c8d

    SHA512

    413ee32dad3d1479bed373ded58d07f6082238efd6af5d1d74f6b19e9e8261bd9dc88d6f5e3863aba396a7be3d017726334b7e263951bffcd782e8bb9e540d22

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    fca2a135cf6db965cafe601f62ae5094

    SHA1

    3e2bede8542059a0efe632fc13fa860e58c91218

    SHA256

    3f01b7bd33acd199fbf8ad71397712ae28f2bef8f205eac0e4a951f813b6d4e9

    SHA512

    f2cb566f6adb95edf31d3b63cda73aa5760fd053ae4174809c576464ad881fffa0ad51b18d5e87b9ac3ada1b079ede23978a004d0a755f7eadc10b09407bc5a9

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    2274467684b205a590db9a20353d8bc7

    SHA1

    d780d261376bc6c8cd2174f0a43e35947980414d

    SHA256

    07f783f2e65f914a03238aa5aec9a98cc2ed564502a9e6ce965b0ab082a67a75

    SHA512

    9e6bd71fd327e505986e957a4f96f660ddace1458a0ec907d180be4b386be684b439beb6520218d418eed70b9fec14fe9c738a45795dec42bf40eeef1d370eb8

    Download Submit

  • memory/3016-39-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3016-38-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3016-40-0x00007FFDE9630000-0x00007FFDE9640000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3016-36-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3016-37-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3016-35-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3016-41-0x00007FFDE9630000-0x00007FFDE9640000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3016-605-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3016-606-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3016-604-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3016-607-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3216-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download