Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

a8477d3ca5...18.exe

windows7-x64

10

a8477d3ca5...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    14/06/2024, 06:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a8477d3ca529aea43cd06a3e9e70360f_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    a8477d3ca529aea43cd06a3e9e70360f

  • SHA1

    1785efcb6447185043b5c0501b232f2229df9d4a

  • SHA256

    88c224d410f03525341083253ab2a38f460f613cbeff633aee88c7af00e7e7ee

  • SHA512

    2b630a32f5c1a972dc356f6b7b249c131fd240d8ba416cf6b1e2264548de897482b4dcc4f36021b668d0d3443ef4d6d6815c43d95fcac13ad72ac276a2f18e78

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6t:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8477d3ca529aea43cd06a3e9e70360f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a8477d3ca529aea43cd06a3e9e70360f_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\SysWOW64\yaowoaqfmq.exe
      yaowoaqfmq.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3016
      • C:\Windows\SysWOW64\xhyhlrca.exe
        C:\Windows\system32\xhyhlrca.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2100
    • C:\Windows\SysWOW64\vghaxuikkeyfxks.exe
      vghaxuikkeyfxks.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2724
    • C:\Windows\SysWOW64\xhyhlrca.exe
      xhyhlrca.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2024
    • C:\Windows\SysWOW64\hanwnyolssjld.exe
      hanwnyolssjld.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2624
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1884

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      d94ff870d277cc7357770d3be6993da1

      SHA1

      2c3a981c44e3627b9ea8b567c261576dcb9e979d

      SHA256

      099e012f5935fb3ae733aacd566f17f8ebf6ccec27b57f3f2d737dc0f9950872

      SHA512

      e83ab92f8e7c5d288fd7c1c9c6004218bd560e84c9bd14844b17cc322f631d2e6fc8d6656a058118bff956edec9e5eff875f1dea2ae773907fbd6d66891ff86b

      Download Submit

    • C:\Windows\SysWOW64\hanwnyolssjld.exe
      Filesize

      512KB

      MD5

      8826daab2da4e65e7946d5601ed13371

      SHA1

      e9add863ced2bc6297bc2fc6ede4e74bd4c1e169

      SHA256

      88126403fc2974faef40b037591649d584aefe49accaf4ec61af74045021280f

      SHA512

      f96ee1d64b10e51809bdb8ec642668e23a55b0cd5d30d54e0d108c9806a378fb5f7fbcf07bea31e89c98f2342879a58f52bc39051c8264e94f26cc381770b6a7

      Download Submit

    • C:\Windows\SysWOW64\vghaxuikkeyfxks.exe
      Filesize

      512KB

      MD5

      b17e0f25e7d0a0d69ced960f244d1dc5

      SHA1

      cfd93b630a22b6d3771b6a0652c0c634d19bd9f8

      SHA256

      198be3f9604aa41bf78d80e3e944dece134f8e0327b5e1539dc9090ee3b9efbf

      SHA512

      605e39144523172ccd9eed944d41a3f7201e3ae0f147628f034a397bd9e775fef42d3101096a9f7c06e0fc5bbdf51400baa15a4efe89b2167024e71d01036f75

      Download Submit

    • C:\Windows\SysWOW64\xhyhlrca.exe
      Filesize

      512KB

      MD5

      c0278c728b36adee9b28d423060d367d

      SHA1

      3de4f12752f141e53c7cdb49ac435856a9957645

      SHA256

      2a3fb73c8f60f7b2844ec409eac567c8dde37aca484142b0837b91c1edf5ec81

      SHA512

      49c419b1b9540ce937b70ecdca486e07ab963210fabdd92f8a1799ba57015d8985883265f9b7da848b5410848994d8c1c4b68e78dd6789338ae807a6af1a6f56

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\yaowoaqfmq.exe
      Filesize

      512KB

      MD5

      9fb362b423e65683480fb651ccb462b2

      SHA1

      56a2df75b321aef30df9ef13401ea6e2d460327c

      SHA256

      8afd38a54cf23a82cb0cdfb7b5de51ea969283a4ae4d8d98dce04437818b4c7c

      SHA512

      dd210b53a532a57589fd7ff8250ba99e9c65331836dd5467f36c4335a777d54b05cf3c979599b88430fc910ae2116cec69faab3e0f0b49b22cdc483c60845a1e

      Download Submit

    • memory/2044-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2840-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2840-93-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download