Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

a8feab2984...18.exe

windows7-x64

10

a8feab2984...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    14/06/2024, 09:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a8feab29842ce3a2b6ebc097d4ae8328_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    a8feab29842ce3a2b6ebc097d4ae8328

  • SHA1

    b2a06eb77a15007146b67358fc4e4bf7a66634ad

  • SHA256

    44e9795f74b21b510afba1766fadb368ae8fc907bc119cfd67dbc1ad41f2d169

  • SHA512

    f0cf22e21e684ae2a9316870ff7de2b805374f4dd1a23c08274404f2e0a75209cce7bade1ee6d5eb12f672b79e3b1c79cd33d8a5f610030e1e22f210c9122d57

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6v:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm58

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8feab29842ce3a2b6ebc097d4ae8328_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a8feab29842ce3a2b6ebc097d4ae8328_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Windows\SysWOW64\senwbyakur.exe
      senwbyakur.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Windows\SysWOW64\oschqkjh.exe
        C:\Windows\system32\oschqkjh.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2692
    • C:\Windows\SysWOW64\lrmdpqmedmxkngn.exe
      lrmdpqmedmxkngn.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2648
    • C:\Windows\SysWOW64\oschqkjh.exe
      oschqkjh.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2660
    • C:\Windows\SysWOW64\xndlceawposbk.exe
      xndlceawposbk.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2608
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1976
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2832
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2404

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      2c928e35e0625ff680100c7883c6f89e

      SHA1

      6116c36ac0ff49ab398cb66afa4d57b35636cbfd

      SHA256

      2f62abb342aa86bdfb6efda2f7332dd0e28ea0dc4eb3166ceeae42f515bd2c59

      SHA512

      fa1f7c2183f8d4735e82f0cd76f1d2b0f62218ab3dc7239cc001355bb0931ecd5387cd45387be355e92892a6b94cbd3f951f387378e2127000e9f27e1b9fb479

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
      Filesize

      64B

      MD5

      d1b2066b43f55ca7ea5c6b64de182acc

      SHA1

      ab4deb6670615dd01a947acf9e0039a116e022a6

      SHA256

      43e7b3ecc767763c6913d1176505de68f0bf826286a9a97aa03f345a44805122

      SHA512

      009fe14532088a3cf26182e30cc6a36581099aa82ee683edae23050ec92470e2c855be5aca3f771d79904e935790983bb4beff9ba903b19d3e17b2ec44f7bb42

      Download Submit

    • C:\Windows\SysWOW64\lrmdpqmedmxkngn.exe
      Filesize

      512KB

      MD5

      9d7777d8bc3f3048922431fbc870b054

      SHA1

      2d6a48e78951fd575591b65505f656cf7d1f8b8a

      SHA256

      72195261ba2b59ab281c8198b62ab856fcbcc1501cff25b7fd2c38115a1982a4

      SHA512

      f5d3f845ddc576a8b38a6b2a7366cf353605d0b5cbb1714fe39bbf762a1446b535f6d10275c41123bc0a21969b15602573f32924a528e704b11b7f8b4986f170

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\oschqkjh.exe
      Filesize

      512KB

      MD5

      82614bc898beafb27d3df11d267544bd

      SHA1

      ec72550f35eef37686ee6de3a3cdafa71941cd9f

      SHA256

      0bde48843ffd274125804bc319a10cb9f16ae3dc20ceb7bd0a4d9ac13ef1ede6

      SHA512

      03d53d29b3b8b4aef93a82bdb9685732e169ac1cf2bfc25b2e2ef11381074ca73c86888169b6c86a2a4b60072135b0204c0c358b692fb7defd8eb52dbc704ce7

      Download Submit

    • \Windows\SysWOW64\senwbyakur.exe
      Filesize

      512KB

      MD5

      0da06b094cb48369719011fdca681655

      SHA1

      969cd5acffa3424ac435de22db89c5434eaa0773

      SHA256

      8c7156be6962ccf6035d3cae099098f793090869e834e628c4cf0dcfca7d8c3b

      SHA512

      52245fed885004c6c4667d271739340ca01c23da3caefb2c33831fb50c8c4b30a351aa52918d9b36ae03bdd0888df467516c56cfed5bea75b958c2cde2519101

      Download Submit

    • \Windows\SysWOW64\xndlceawposbk.exe
      Filesize

      512KB

      MD5

      5333f3e4f92f49885e12c5f373969ac5

      SHA1

      e184410e09188af3f21a8558e882b1298e812e9a

      SHA256

      e935318aee0ebb034ddcef90b2ece2814b68412027fb9111ae63e260cdfaf19f

      SHA512

      49d7790d8669dab3cf2dcacb7aab1afa342ee4ad320ecb5b95e4aeaa2078068ea04078f2ed67db5d3d4bc423eb3c428e9082470a4640e331ab644c8354c86df7

      Download Submit

    • memory/1976-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2108-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2404-79-0x0000000003AB0000-0x0000000003AC0000-memory.dmp

      Filesize

      64KB

      Download