Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 16:23

General

  • Target

    879f0eeb24b183f4f35a09bb474f7fec_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    879f0eeb24b183f4f35a09bb474f7fec

  • SHA1

    3f1c6a5fa8f3242f82ee46dbe81a1071bd045a28

  • SHA256

    4b04bc91719f8d04209ef9f520fc2cb27e863574fd1f1f9ca95c8c1fef51a9e7

  • SHA512

    43942d690188d9785e5560599e03557e714c7021d556a6786dc0560ed60c9fa36a8181c6b2eea45738aef0715a3f8cd73f3c01b3b22ec9dfccd0b544edb6e416

  • SSDEEP

    24576:yPX2vzp85e6oUS0FLTIiQ64berdI4iuKbQaqfQN+QfsqV:6Gvz0aUS0lIiQqdI4qfqqB0qV

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Executes dropped EXE 33 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\879f0eeb24b183f4f35a09bb474f7fec_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\879f0eeb24b183f4f35a09bb474f7fec_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
      "C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe" "u 'http://www.freeridegames.com/spdo/feeds/sdmConfig?camp=%s&serviceId=143&gameId=%d' p '143' c '670850' m 'playfincom' t '0' l 'Default'"
      2⤵
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4836
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        UHR
        3⤵
        • Executes dropped EXE
        PID:952
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        UPR
        3⤵
        • Executes dropped EXE
        PID:4992
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        ER
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4680
        • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
          R
          4⤵
          • Executes dropped EXE
          • Modifies registry class
          PID:1112
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        UHW
        3⤵
        • Executes dropped EXE
        PID:1532
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        UPW
        3⤵
        • Executes dropped EXE
        PID:4476
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        EW
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3736
        • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
          W
          4⤵
          • Executes dropped EXE
          PID:2160
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        UHW
        3⤵
        • Executes dropped EXE
        PID:2624
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        UPW
        3⤵
        • Executes dropped EXE
        PID:3464
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        EW
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1272
        • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
          W
          4⤵
          • Executes dropped EXE
          PID:5100
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        UHW
        3⤵
        • Executes dropped EXE
        PID:4744
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        UPW
        3⤵
        • Executes dropped EXE
        PID:2196
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        EW
        3⤵
        • Executes dropped EXE
        PID:4884
        • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
          W
          4⤵
          • Executes dropped EXE
          PID:2828
  • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HR
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1092
    • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
      R
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:2220
  • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PR
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
      R
      2⤵
      • Executes dropped EXE
      PID:4580
  • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
      W
      2⤵
      • Executes dropped EXE
      PID:3500
  • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
      W
      2⤵
      • Executes dropped EXE
      PID:4888
  • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
      W
      2⤵
      • Executes dropped EXE
      PID:4288
  • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
      W
      2⤵
      • Executes dropped EXE
      PID:2072
  • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW
    1⤵
    • Executes dropped EXE
    PID:2684
    • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
      W
      2⤵
      • Executes dropped EXE
      PID:3988
  • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW
    1⤵
    • Executes dropped EXE
    PID:2368
    • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
      W
      2⤵
      • Executes dropped EXE
      PID:740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

    Filesize

    121B

    MD5

    daa98e544d39031af5e9b7e9e1073d99

    SHA1

    2782e707ef3c5a8109df83077c48bfef81ef2a36

    SHA256

    475524d562a7383e391b9888cd09ab3d49483ddedfbd053227d7b638528b4510

    SHA512

    f5a9e99ea5ab64fcbcadaee314f32a060016ee4a7ba179e48fc330a567fe9883393519ac5a829f4dadc332f819167e43aada67ecf9e809efb86a8620e7eebcd2

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Temp\ietemp1.dat

    Filesize

    307B

    MD5

    f3c672bec6b75cfc96cbd3ab594e600f

    SHA1

    c9ce73cec8de475e73561c262294db3d1f19b43c

    SHA256

    fcd34903e7a688611f3f4edd7b86a7f19814b514dec13ce8a4154b734eaa9650

    SHA512

    3c0e8739994e401c74073636b6de58e59285521a69da2cfbb3d8e9680d593b30709b8d48f90f89f34e59dc16daa3887c698ee1bf83f08acab3de5b1f0a2aa1d8

  • C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ietemp1.dat

    Filesize

    23B

    MD5

    4174cb800274e3c271f7e53ae1b9ae35

    SHA1

    6ac0ca77eef3b68c8db3349f1ceb0c8083450642

    SHA256

    d5e0a12b015868fdafdbdcef807fee6bf17e326db04c64079833e829bf34112e

    SHA512

    c73823299a4706ad1feec4497c1e01c598beebe5679a1bbae2cfa6305b282f719c5c14c1fbc3d982db111cda6cdcc7721f22880391155ae9112f6b5f1cdb7cdd

  • C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ietemp1.dat

    Filesize

    105B

    MD5

    384ac701443d0931fb37f833adcbda29

    SHA1

    186cc7fa3809ec970b8e133002ac61ff1bd6219e

    SHA256

    ae2c06d3936194b4f2746a8a973fb5616bca1078a0fbbf0327caab1b39a911c6

    SHA512

    2e8f66b732b2f3d95f510cdd9cc79d7d160d37ec2d52021a778c6ff692f24eaa9ff6b479d86a02c039e287efcf0d04a8e4560d74e4f0e423bbd6336f86f69902

  • C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

    Filesize

    504KB

    MD5

    f7a4ce326cd8b7a2e3e8b1ad80aba89a

    SHA1

    fc00c30174b1c61c4400cd94285f944728b8c1fd

    SHA256

    78793e27ce8c0794a036423e65d351851ed662b941f33a763f3db4ef0a6b546f

    SHA512

    74c7fdf75f66e39708de9e89e8aebb0a38b31c3c4b170dc6cc943b3aeee900ed080ae3d77af18dd54dcadfa4ecca810d01b3b3cdb35216cb8e9b028e668fb2b1

  • C:\Users\Admin\AppData\Local\Temp\SDM143\Splasher.dll

    Filesize

    475KB

    MD5

    41d94c8eb8cb17e04f8ec6e14132f9ca

    SHA1

    add92b031eb36b26335763780df88bca58636ed7

    SHA256

    2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96

    SHA512

    0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7

  • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

    Filesize

    234KB

    MD5

    3a9774028e1e3968b8c202fd199d0084

    SHA1

    6e19763c3f42c8d6596135a7566bef07a0cbeadd

    SHA256

    93a63465ea363661a141043c404f5b94ab9ac6cfeee3fd158bdf4e1fc50e3af5

    SHA512

    ea7e67887d7b8fd3e6049ee1ba7a786bb895158279e464c5c7a35e323aefac34e81e5515e493acf447953a08f13b94024c4a460ebc77f03ef0d305feb8b81d06

  • C:\Users\Admin\AppData\Local\Temp\SDM143\resourceDll.dll

    Filesize

    171KB

    MD5

    5cf0fba9e8775382233c8e63e52c838a

    SHA1

    b2a092f71eff0f6916652d7f3bfde9204eda5636

    SHA256

    7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5

    SHA512

    73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25

  • C:\Users\Admin\AppData\Local\Temp\nsa4835.tmp\System.dll

    Filesize

    11KB

    MD5

    a436db0c473a087eb61ff5c53c34ba27

    SHA1

    65ea67e424e75f5065132b539c8b2eda88aa0506

    SHA256

    75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

    SHA512

    908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

  • memory/740-135-0x0000000000800000-0x000000000083A000-memory.dmp

    Filesize

    232KB

  • memory/1112-71-0x0000000000020000-0x000000000005A000-memory.dmp

    Filesize

    232KB

  • memory/2160-92-0x0000000000CE0000-0x0000000000D1A000-memory.dmp

    Filesize

    232KB

  • memory/2220-61-0x0000000000B40000-0x0000000000B7A000-memory.dmp

    Filesize

    232KB

  • memory/2828-122-0x0000000000F00000-0x0000000000F3A000-memory.dmp

    Filesize

    232KB

  • memory/3500-78-0x0000000000010000-0x000000000004A000-memory.dmp

    Filesize

    232KB

  • memory/4288-100-0x0000000000330000-0x000000000036A000-memory.dmp

    Filesize

    232KB

  • memory/4836-52-0x0000000010000000-0x000000001009F000-memory.dmp

    Filesize

    636KB

  • memory/4836-50-0x0000000010000000-0x000000001009F000-memory.dmp

    Filesize

    636KB

  • memory/4836-47-0x0000000010000000-0x000000001009F000-memory.dmp

    Filesize

    636KB

  • memory/4836-44-0x0000000000400000-0x0000000000553000-memory.dmp

    Filesize

    1.3MB

  • memory/4836-156-0x0000000000400000-0x0000000000553000-memory.dmp

    Filesize

    1.3MB

  • memory/4836-157-0x0000000010000000-0x000000001009F000-memory.dmp

    Filesize

    636KB

  • memory/5100-115-0x0000000000E40000-0x0000000000E7A000-memory.dmp

    Filesize

    232KB