Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 13:03

General

  • Target

    80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe

  • Size

    200KB

  • MD5

    80d3d1ef1c88e47ceb92bce45364db52

  • SHA1

    9bd2e1f0e51bd5b134d32dd1fdfb3dcc36bcd5a3

  • SHA256

    24f03f95db73c5543937122461a71a8dc87670b69729d5f7991ac8a00d5a5173

  • SHA512

    d46e63a1653dc8c090a348949749589f317f5059411f7351b86944c41dc321261d1dab8079c083ad7f5ca83f0322618b0e8c7720dde109fb253aad2078d8d2cf

  • SSDEEP

    6144:Sz+92mhAMJ/cPl3iwTaozlx/LVXHSPF0Mfi:SK2mhAMJ/cPllT7VX5

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\wsmallstub.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\wsmallstub.exe" "C:\Users\Admin\AppData\Local\Temp\80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ct246728.ourtoolbar.com/ie/?IsOrganic=true&RequesterId=DMStub
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3764
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8edc746f8,0x7ff8edc74708,0x7ff8edc74718
          4⤵
            PID:1588
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
            4⤵
              PID:1748
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1428
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
              4⤵
                PID:3148
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                4⤵
                  PID:4392
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
                  4⤵
                    PID:1336
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
                    4⤵
                      PID:3712
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2540
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
                      4⤵
                        PID:1848
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                        4⤵
                          PID:1332
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
                          4⤵
                            PID:3828
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
                            4⤵
                              PID:4432
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:2536
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4756

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5672d33f-9910-4ea2-afe8-c545fcb1648c.tmp

                            Filesize

                            11KB

                            MD5

                            98fbbff6a6a1a2d390718aabf20657de

                            SHA1

                            d15eb780caa6de7ba9324198f50cf145b5f35f3f

                            SHA256

                            4ec3f3854472c3edf57658862170f8140badbc283cc7f2a3c040b3970ffa64e1

                            SHA512

                            89e6142ea7dd885cf803e78b32af111991f7460838502c86d40979cff3e23b409ce98fea8fbefa3dd7cee2bbdcf2ca12d1f06bc8edb8eaca41eb33351ac59d7b

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            439b5e04ca18c7fb02cf406e6eb24167

                            SHA1

                            e0c5bb6216903934726e3570b7d63295b9d28987

                            SHA256

                            247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

                            SHA512

                            d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            a8e767fd33edd97d306efb6905f93252

                            SHA1

                            a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

                            SHA256

                            c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

                            SHA512

                            07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            120B

                            MD5

                            b1fd5648cff0caa5b307844f71c0ae00

                            SHA1

                            3ba1541fe8d0a2edbc21152fe5b07f3ae03ab578

                            SHA256

                            e0b5af8ef7edcc667aa5bc45a4a7db7dca1a723a65d10607de70d23b979d3acf

                            SHA512

                            314b5167e526c166a5bc55b3aa9c370bd2bc8d646a8a567b0aa1ef6d632acef4c1a72f0992dd549d867f0dafb59af4a347f9557e77d41f3ab1167c5eae255aca

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            638B

                            MD5

                            255a7f2eeeafbe3be7bcf49ce25482ae

                            SHA1

                            c87c1b7de14a9aed1fb2f77dbed993cc5d9456c2

                            SHA256

                            1ab2d5bad01c88651319a50b396c75cc7d46b5d8d06570a455315b31c227df37

                            SHA512

                            d617fbbae58a32c43c0949a5238c3e5a82a53d487e959acda22275b8785c02f195208f2554655d09fa78729ecae9f00b4261529a356f4020827a76dceef4a9c3

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            9bb94af235f333b416e1bfda359ed432

                            SHA1

                            ff619940917fec3620ea54602ccfa877a3baf1f5

                            SHA256

                            9e09fc59dad4f92dff9703d46ae3bd1c7d7ef3eef6869908175ebda7f47e4f27

                            SHA512

                            7d1390543e61c648406045a1c93abfd9f1471e6ebf98cae584d6006b5b1df7491610694dbc711738281fb262f307119a83636c292f5b12490f3b275c02709bdf

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            c21c81c7be21cdcda862fa27d4cb784f

                            SHA1

                            19ea97560b278f615127fb9826a60570309c6989

                            SHA256

                            2dca0acbd48badd811c8e578be1a16df356cc922c69a72c18924c47144ae393c

                            SHA512

                            2a34729aa0c006bdf69e305985bd9d28932e9f7f7390ac48f8c3b6cb83c2ba5acd72364d2bbb6ffd50bde21f5f784c0ebfd52b0e797f97b0baa29d9e10239718

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            206702161f94c5cd39fadd03f4014d98

                            SHA1

                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                            SHA256

                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                            SHA512

                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\icon.ico

                            Filesize

                            1KB

                            MD5

                            f31ab27282cf444ef1f263320be6b705

                            SHA1

                            bde4d76ffc88d14e1128b4928ddd4639a7744b84

                            SHA256

                            1a3ec42f393635307ae2e369ef50a8eb0fbbe02cd2f82c4c6d3486d294ddcceb

                            SHA512

                            f6b803b087444de0cc6fa832c4be491c738c0d643895d844a861357e2b29257fe7ba91f2e4e61ee715a5b533b0449c14428f79ec651f3cfa3823eaaaa99ca367

                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub_settings.xml

                            Filesize

                            3KB

                            MD5

                            a5ac78bfd8368777da3adc467c521a08

                            SHA1

                            cddb90665bfdee156dd4993680ef18f511aee9a5

                            SHA256

                            6f99bff6e083f2fb83a3ee78acc7c3152c34a59fec0807846dfe7498251c26d8

                            SHA512

                            2156fa8e601d5dfbf07e1aa550540d7fb753c00b614e567297030eb40361b85575c5a73403b02fe7ddbc28118a250ad9984732bef2588eeac6951c3896d9a98d

                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\wsmallstub.exe

                            Filesize

                            238KB

                            MD5

                            bebe87e70601cbc95c4a6bad2a2e986d

                            SHA1

                            f9620534bf97ff4ecaadd3afc3808d3abecdac65

                            SHA256

                            f1fe856f82e455e19d17f09e0b8529993aa540d4231c07065f0c28ecf0f25dd4

                            SHA512

                            dae6eabf8314529be871d56c4c573cc114309d77a5223f48227d0c13964cd6606efbe413e8b1fdd7624be89fc31be8caa7d299ed2e659f9c4e1982f21e1cffd2