Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 13:49

General

  • Target

    08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe

  • Size

    31KB

  • MD5

    08e2acedfafd16f9265a4a7ae879d403

  • SHA1

    df9c4c8355d4f55de7c07789b8f64190fe8f5b95

  • SHA256

    7bedb2b96fdd9e645eaa1eefefc30f116102b887ca6c707e8675ad8618e955e1

  • SHA512

    0155bde4aaabaf3c5126c82178e015b0bc1a13e2c7737fa2422f1d09f10ec1b7f1a4fd523967b5c47589beff9b48970df14cece50e19af774e31479a056720b2

  • SSDEEP

    768:bRCtZG+ZCoOC9nR3M2NvaQITXXEdV9LQQ5Z:dKYEPNvjITX0P

Score
8/10

Malware Config

Signatures

  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver" /v DelayedAutoStart /t REG_DWORD /d 0 /f
      2⤵
        PID:4208
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d C:\Windows\system32\lld.cvsvres /f
        2⤵
        • Server Software Component: Terminal Services DLL
        PID:384
      • C:\Windows\SysWOW64\sc.exe
        sc config lanmanserver start= auto
        2⤵
        • Launches sc.exe
        PID:4100
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Windows\system32\lld.cvsvres StartUpA
        2⤵
        • Loads dropped DLL
        PID:5116
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
        2⤵
          PID:1756

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\Driver.inf

        Filesize

        192B

        MD5

        e2b127da80c9f0e027562592b213766c

        SHA1

        707576dd9620ac9646544996b01e6ced45639867

        SHA256

        6e34e0e930c24a31b33ec48fb94d069e9c765b671f199852aecb0ea82616595e

        SHA512

        971787891317e8533a19872621c0afcd491fd266b8663f5b6aa9508a05e0dcf586300274cbc5ae530e3bb56dded4a36505f6e2392b2431251dce5efbedf1f5bd

      • C:\Windows\SysWOW64\lld.cvsvres

        Filesize

        24KB

        MD5

        766c1ad36519f7e484c2effcfac292d6

        SHA1

        657d6effaa6eaa63d0f4b45770f25fb8c85c73e4

        SHA256

        45157cc3e155fe7c3b42e2ef4adfc9ed227793f6f3414a89e18a5f761032cfb6

        SHA512

        5547628a31dd8ae53aab76bddd34c9328bedf2a0a08bd78b56ad903ac1e6e200e97ab9a1f92bc7fa601a091a04e08a0ea98491aa6efa53f296d609d45ff69998

      • C:\Windows\SysWOW64\msws.dll

        Filesize

        388KB

        MD5

        8d7db101a7211fe3309dc4dc8cf2dd0a

        SHA1

        6c2781eadf53b3742d16dab2f164baf813f7ac85

        SHA256

        93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a

        SHA512

        8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83