Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

88fd17b1aa...18.exe

windows7-x64

10

88fd17b1aa...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01/06/2024, 01:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    88fd17b1aa4a3e3b207fe2d4847ec4f5

  • SHA1

    103089c5157c5c95726c36e132246ce5957b405d

  • SHA256

    c9e9982543a468ec2505b213c1699f110fbce01333d3d0c8f3885f786d8f417e

  • SHA512

    fce12722ce513dad14fecba2c69fbf85a632b66bba848fe64dd6e32577e3b84802f9378f05247bcc9bc049caee470049afc929d26c6e2eaa89ae3b0b195ce5fd

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2696
    • C:\Windows\SysWOW64\imbcxqjunz.exe
      imbcxqjunz.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2448
      • C:\Windows\SysWOW64\nelrvewz.exe
        C:\Windows\system32\nelrvewz.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2524
    • C:\Windows\SysWOW64\qftabfxakhycskn.exe
      qftabfxakhycskn.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3040
    • C:\Windows\SysWOW64\nelrvewz.exe
      nelrvewz.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2648
    • C:\Windows\SysWOW64\zxsbyczqxwzcw.exe
      zxsbyczqxwzcw.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2480
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2704

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      895acee1de11da04f6fe6559193cc157

      SHA1

      ba314f00e5de1d4a6c139feadd51a37023b3d8de

      SHA256

      64e2bb6fe7dba0b798291cb3498637b8c38ee630267227882dedfadf45932f22

      SHA512

      d076d08add272870896dbb19c85b320165b74ff03ce38f27e08748cd50a7cff8c8bf97ad81cb59ad8eac9e3d4cc7d2c7d7f1669b3673bb0110f76199dcc87d02

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      5116d4d3237d9e00ec353b1d3b483134

      SHA1

      4add980405584c809f2310aaab2098a4c0837087

      SHA256

      b86ea1a1b800c377080c091445f7b3ef32a5eab8bef6b75aae4cb376849e1ad6

      SHA512

      925e5c7dfb34a1ac0df9eeb5356ff9fe7cbe852858e7989a9e789068b0e9612b9c2f46022836fefb36bcc0cbf45fbd2a2c6b280309cca29656ca6d5d250fae2d

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      d026911cf5298adecf4a3cda0d422bfd

      SHA1

      ca155f573f3570088af428baf715a6b25c0d2a41

      SHA256

      a245a3fb8aa3d93b50abc5ada70c06b092f8f5a0050819713419c6d0263e0a79

      SHA512

      d3bd277ef6665b1a9fee2f1406064e8a7dc17de7a73a42c2f05a0fe3b7c5a63f0832c4cffd64cc5827c4eb6e3ff9612c3c08f08e08cdffefcdda07916f50ad2c

      Download Submit

    • C:\Windows\SysWOW64\nelrvewz.exe
      Filesize

      512KB

      MD5

      0f7400603e5b66e93c4a702cd3698ba1

      SHA1

      0fff9b067e68b77cdc5a9c53482ca4143fda8ebc

      SHA256

      1d3815971ea2afb57ebb1eb754e4e64f09c0f4e8b1523422d3fe52aa3385391f

      SHA512

      c9c73c8d8d1e9b6bf4f86ef2e07de11eb367d2568fc59cf2570be56fb0a6f582a15a96791884a6982d319fc6e56633cc76cd4da268a48a0cb6d472e24e76879d

      Download Submit

    • C:\Windows\SysWOW64\qftabfxakhycskn.exe
      Filesize

      512KB

      MD5

      b98a7b700658f4358f339bf1ece03907

      SHA1

      3ca16d973cee632e22a9e36a257df6d83aea4809

      SHA256

      07ae83215946d9266d536f7f0a6145112b5fd69abf6e94e0feb36f756caa5771

      SHA512

      9e15e592fbcf8e610810464cb2e0f7d5d984fcb7fb8513c3bcb5536d7853eb651f6245bfd9c2a8a7061a701069b8f88561fddf01d51c9160ec09d1287325add0

      Download Submit

    • C:\Windows\SysWOW64\zxsbyczqxwzcw.exe
      Filesize

      512KB

      MD5

      3f80db17f8e1a6776295fe0194b67d38

      SHA1

      25edde626135049f5811451c118411c48fac58b3

      SHA256

      7a11be6177e77ee58bfe749fb2f3f1f83f443629b04a4465b537fb0d5c1e8bfa

      SHA512

      53acfc3221c0fc9e9f03e88b0375cb609f337471409a537b6e07f67326fe7f18eb67cb47eb2d83b1bbb8eddb869c352b5ae3416e678a4db1a40489461de7b226

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\imbcxqjunz.exe
      Filesize

      512KB

      MD5

      558b06473e52c490ee8cc5630c6d157b

      SHA1

      3f5cb5747b613ea76d1d0a3852654a4cb9c2705d

      SHA256

      ce24eb56abef495b3d0fd53f242514b673a30b76f0f958b72825aced72cdecd1

      SHA512

      2eeac0bfd4b1bef1c46d1db5740169d00cf184dacec4285fcc09ee1a68d661e28df6fcea526295b8f0c9acdd012ec4f12c884ea2d32eeb71780b8316e1bcdff4

      Download Submit

    • memory/2348-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2348-96-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2696-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download