Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2024, 05:27

General

  • Target

    83299ddb0aeedab9ccb3bef2ef829144_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    83299ddb0aeedab9ccb3bef2ef829144

  • SHA1

    f70cc92c38ccc2209e94329d42eed600f6625c2a

  • SHA256

    4eb8083af35bd37f03a3e1e8e1f69a5443e0266bc3530468028a6eaaf1f93ecc

  • SHA512

    95017cc73fa450c1ea3d3515983ab54ea799d939fb1d7340f29b6ee0c177651401c85adaac4b22f9337c0cf566059a62fad70848c2ceb88d6ed87bf29c080703

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6v:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5S

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83299ddb0aeedab9ccb3bef2ef829144_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\83299ddb0aeedab9ccb3bef2ef829144_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:400
    • C:\Windows\SysWOW64\yexggeuhhj.exe
      yexggeuhhj.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Windows\SysWOW64\sdehaiwj.exe
        C:\Windows\system32\sdehaiwj.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1140
    • C:\Windows\SysWOW64\hvwpcddlfusmoou.exe
      hvwpcddlfusmoou.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1848
    • C:\Windows\SysWOW64\sdehaiwj.exe
      sdehaiwj.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4196
    • C:\Windows\SysWOW64\vsdmfruzoaoth.exe
      vsdmfruzoaoth.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4168
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1864

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    512KB

    MD5

    94c8f35bc58d246ba4e1236944a9d082

    SHA1

    28645c167d6f73325b4304cb8daf33da9c456afd

    SHA256

    230b8a82635051b9a8671d89eb8aac9d413c026532fd1a731cc30e3b1ccc9d94

    SHA512

    370eb55e8817ab836a2878ded1bb8268c6312bb9f5e5928eb78edb077dae5f695b37e487a3edf7f1e656ee6b83d2cabc32da8f52c1a3878285f139376e06ce38

  • C:\Users\Admin\AppData\Local\Temp\TCD7C86.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    239B

    MD5

    361ba5cdfe246f4303b0a1638e0daf43

    SHA1

    eced7199b1af3c8e92209a68cb9a925ff3f369a3

    SHA256

    507143acb38e64408d03a0dd98e16bd34ca557294c466ae8ec9c7c763eb3a2a5

    SHA512

    81b9d124396d138717aea4dc71cec59426a3b65b47eaa0d13523adf030c5e3df9fa670ed48f7634d0301812d4b546dd43bc5bf863b58112570a2ab049bc7ab54

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    c3acd0353dd0081f8aa35d4d02bd7b18

    SHA1

    1077fd26a450ef0fe5270729d768a02166335b69

    SHA256

    c41a7cb48c11841b98debe44ea2ac45a745183e0de84164463556fbb1dd7295a

    SHA512

    f0e3f3ea3cf89ba727069aa7f7eccd0491a6b0470d0fc66d6b5e6dcac3c88446884032161913e5b1092a3ff519f124df063ac6d4c8f94a883ed0b79ee8bc326a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    1fcb7fe37128db9ec825d7a880d7afe3

    SHA1

    95ec91f756740d0591cf7d82ce09595cb3cc2552

    SHA256

    d4b6e2ea43916f21bda634a6647de0e9f90a70a32adfd91b25d42e416942b921

    SHA512

    85e5a67da45a3eaade68c0af4e0ad82a3e6520f74bf5c8991d2c8a0657e2e8cf38167376e5b3510634ad7b8286e00ceb6a42f130ef9aa92213fc38090eb161d3

  • C:\Users\Admin\Documents\InitializeFormat.doc.exe

    Filesize

    512KB

    MD5

    801a7b65597bced081bec1f2af528d24

    SHA1

    feb240ff37486a2177400d58c9e5f3d09798a279

    SHA256

    b544484a8157660f85c0599d0c570d2118de6cd4b6251eda11fa17a1428e4c44

    SHA512

    1a08c1e0c74e21242cbf5f3d681d32b13152dced498a3fff4f62fc3aa44136d61dd4d41f41cae085bbda57e29d946ab10adc8b2ed09e925329d44b0f98548d75

  • C:\Windows\SysWOW64\hvwpcddlfusmoou.exe

    Filesize

    512KB

    MD5

    e3f07379f1e4d0ac3f6a1608c01f34e0

    SHA1

    a8dd581373595c30c712dd7d2f4ab5c7221c9194

    SHA256

    3335dece352da194e143bd2e382efb4dc609c94c5e8ef6414eded08baaedfb9b

    SHA512

    c61ff8e6b1e40b70e932e6121a9eaa724f33977c0e89d5bde34e05df89e8282df43afa4b430807dac523ee05f03e18f8e6d31e0ce1d811d8f2017899055fb0c6

  • C:\Windows\SysWOW64\sdehaiwj.exe

    Filesize

    512KB

    MD5

    c94a81a08478e732bd20515f7262efdd

    SHA1

    1d462391618b8385cb63324ec82a6e53b4d3ea63

    SHA256

    e1e69a437a33a7386804e04ac4d4c73fd0ba70e506d88f2a60f8edd3ea37bca9

    SHA512

    694058e87060dbb8c1430c0f12b3983956037cdf7bc681f6910fb050233aa63009032189735c9967e4db45f1a29d6f6b5a2b56ef87f78b7707cd92f726578947

  • C:\Windows\SysWOW64\vsdmfruzoaoth.exe

    Filesize

    512KB

    MD5

    ac5fff52b76f86460317fa746019d6b2

    SHA1

    1e339e2b29b8810eef22036ce44786a83c1a8fce

    SHA256

    c4512f854045f50b949e51743a7c036e14680f2f0644be65f0db6ad9cdc1202f

    SHA512

    25c25a98d687d4d3236702378ae304f2d41d6f86fbfb328f948683471eb16a69b8163a5ace9c39f698a6accfd6d7cb8ce1a381b5a82cfbcb53128af56c932906

  • C:\Windows\SysWOW64\yexggeuhhj.exe

    Filesize

    512KB

    MD5

    25197fa84a63daff9e3279cfc7f0247b

    SHA1

    9d6bf701bc55f39513b1ace7b6d46bfc897efde3

    SHA256

    8b05823532cdb75aec4baeadcf8c9b0472030c828196baf1967fd43ad6583a5f

    SHA512

    e6b96841a628b58cf9f38c15356e5b7cf5ae93641a0dd0e5263a11ec0cf30a62f43eb3ac5e5f530bcb9106278f3ac9bd422464e26378653b0f8b2bb7d433d9d1

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    512KB

    MD5

    d2aa11e591d57a74f0e551007f0d0b77

    SHA1

    4932bf69a93bc86cff7d779e4dd2859d760b567d

    SHA256

    cae1ce0d4a38ff280b37cbc9555fd1b82cdbd7958d73ccbd3a667785d397b5ae

    SHA512

    3c727d93c673befa9b71bae9d66f0c6f64cad4b1ddd655626076410bf23b89813ce90ac207080964fa2b2bc8896c0f6f5be998b924e0f382cf40631e9c7fa831

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    cf6a18837c4c26acee0ba5b50cc5b378

    SHA1

    ddbf8337ccc8fc4afcabd99ffdfab5014ca1352c

    SHA256

    a7a15ace51da6755012d578154a4bf9041a0f53af71e2c2bca40189dcd5029ab

    SHA512

    cdab0f6bb23a399abf9c1a75d2b30e1d36904c89e15a02098b25258495cbb46612256900e70c5d274091a95a25aa46ee5e697250bbc6118c13bd8060d2f45763

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    e68e8ede78c011887298439056454991

    SHA1

    ca925c5afcee7f7f72afaa39beb53be20c4ebe4a

    SHA256

    d9c027392a458e3207b301adffae88489f319bae4e8bd0136ed6d34e45157746

    SHA512

    df64c0b7f9ba040746d34329094381dcd23e759e8242ed02ae3d9d369f3fefc92999b89f3c3adc713ec82c22666f0e995fdb78a92a61528d19eb82830d8a3e68

  • memory/400-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

  • memory/1864-38-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB

  • memory/1864-40-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB

  • memory/1864-43-0x00007FFD29D70000-0x00007FFD29D80000-memory.dmp

    Filesize

    64KB

  • memory/1864-39-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB

  • memory/1864-41-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB

  • memory/1864-37-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB

  • memory/1864-42-0x00007FFD29D70000-0x00007FFD29D80000-memory.dmp

    Filesize

    64KB

  • memory/1864-610-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB

  • memory/1864-613-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB

  • memory/1864-612-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB

  • memory/1864-611-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB