Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    49s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/06/2024, 22:19

General

  • Target

    13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe

  • Size

    239KB

  • MD5

    13ad479f43406e00dd2eb7599be31527

  • SHA1

    5aaf553aee6b73fe0f46f74987101647b002706a

  • SHA256

    0d1dc5f2f30c132fa08fb762029057458f71c115c71eae8184e45a87e2607353

  • SHA512

    44fcbc5081c0dde42828c2a6fcc4fb79a936253a6788de4809e98502df82c75dbd48ae315c753461b194bf1f98986fa9b6fea89ca0c6ae59bb3691fa1da303b2

  • SSDEEP

    3072:A7mXb6igvd+2s7OBRgaPee7Ly2+XysjmyzSu8GSp0G2Rc+jUoC+:Amb6igk1O/gpe7GP5jSRucY

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies firewall policy service 3 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:616
    • C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe"
      1⤵
      • Checks computer location settings
      • Drops file in Windows directory
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Windows\svcchost.exe
        "C:\Windows\svcchost.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:2328
        • C:\Windows\SysWOW64\Taskmgr.exe
          "C:\Windows\System32\Taskmgr.exe"
          3⤵
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4580
        • C:\Windows\SysWOW64\REG.exe
          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
          3⤵
          • Impair Defenses: Safe Mode Boot
          • Modifies registry key
          PID:4772
      • C:\Windows\exploree.exe
        "C:\Windows\exploree.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of UnmapMainImage
        PID:640
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 344
          3⤵
          • Program crash
          PID:1040
      • C:\Windows\hsl.exe
        "C:\Windows\hsl.exe"
        2⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:100
      • C:\Windows\scss.exe
        "C:\Windows\scss.exe"
        2⤵
        • Modifies firewall policy service
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of UnmapMainImage
        PID:2904
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\154.bat" "
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2484
        • C:\Windows\SysWOW64\chcp.com
          chcp 1251
          3⤵
            PID:1056
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 640 -ip 640
        1⤵
          PID:1968

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\154.bat

          Filesize

          166B

          MD5

          ca936c1244fd78ec8a6b5f23c92f9f1b

          SHA1

          644f0296439c1c175d399a32bc8929cb692579a6

          SHA256

          076b593a8d250953a255ef4cead2ee673b36e194ccf5e24152ce8b4c2359a925

          SHA512

          44f179e904cfc5d1f8293ec5fe5768a438735850bb93e9da3eb3f956eb857dd86c05b15b1aa0c968a2bf4b3b473d71aa88c92c48a9db401e0d2cb7df6fc87c35

        • C:\Windows\exploree.exe

          Filesize

          35KB

          MD5

          31112dedf5f25bac5aef4c8e344b48f2

          SHA1

          104551348e450ea824d9469afc0189a342140290

          SHA256

          d346171cee29cb55204afeb44284480ebcbddee8000ec944a63f2655f0dcdb65

          SHA512

          2ee76e84b70109906ff37cafe58c24ea0b88a2846a43290fa7ecd3abc3b754072dddea8af2b2375df10a7da4c97ceccc03d6f4fcd8243f94b7838072cf03262f

        • C:\Windows\hsl.exe

          Filesize

          93KB

          MD5

          bb389d8f47db4a872087c37249b5347a

          SHA1

          8b6c0121e46b4af94c941d25fac2f2e7a3092b8d

          SHA256

          7490c42628d70c748b16387e66c33b5989c24b6531a949d5fa10d3069d90adad

          SHA512

          7b6c0ba266a9a611c2e713aeceb0b78a0400a405dbf48482fd0cbe00ea674591e324ffadb7900d4e9d444e81522c111e982410ebfe2f98e9eb2870df9a0f3950

        • C:\Windows\scss.exe

          Filesize

          42KB

          MD5

          875d7d741e71b84e8d620e96b442ffc8

          SHA1

          34b1d6223940df1e2c47e441a84451d11c24ed6a

          SHA256

          9820f333dbe7cbd6ba2064999e7368efc3b4ce114925ede6d96d5fdfe3b1e909

          SHA512

          7b0e3264197e52ebf6b701cb051f749008bf489ff02133b38e4a71111309d1eff3084b2428cc3ec0dce6472a2d0ac4ad3e6430daf701f2777f1852c69fd72180

        • C:\Windows\svcchost.exe

          Filesize

          50KB

          MD5

          96536128805788b05b9335d674c19e1d

          SHA1

          a44cde59321c0f9bb07ef975efc8370c8a51e23e

          SHA256

          69693ac781a21bad65c7962e0afe1157c7cfcd088675a62a6afd92347178f2be

          SHA512

          537e856222506c1200796ce750bfd12bb9933558f1e484c1cc4f1dfc2610385cfb4d2d0f72a9f4d125d97b47060289ff480fedfe64fb6e96c9c302cdd9ab6e1f

        • memory/100-47-0x0000000000400000-0x000000000044B000-memory.dmp

          Filesize

          300KB

        • memory/100-52-0x0000000017180000-0x0000000017194000-memory.dmp

          Filesize

          80KB

        • memory/100-53-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/616-92-0x000000000CED0000-0x000000000CEE8000-memory.dmp

          Filesize

          96KB

        • memory/616-106-0x000000000CF30000-0x000000000CF48000-memory.dmp

          Filesize

          96KB

        • memory/616-131-0x000000000CFD0000-0x000000000CFE8000-memory.dmp

          Filesize

          96KB

        • memory/616-127-0x000000000CFB0000-0x000000000CFC8000-memory.dmp

          Filesize

          96KB

        • memory/616-121-0x000000000CF90000-0x000000000CFA8000-memory.dmp

          Filesize

          96KB

        • memory/616-116-0x000000000CF70000-0x000000000CF88000-memory.dmp

          Filesize

          96KB

        • memory/616-111-0x000000000CF50000-0x000000000CF68000-memory.dmp

          Filesize

          96KB

        • memory/616-101-0x000000000CF10000-0x000000000CF28000-memory.dmp

          Filesize

          96KB

        • memory/616-96-0x000000000CEF0000-0x000000000CF08000-memory.dmp

          Filesize

          96KB

        • memory/616-86-0x000000000CEB0000-0x000000000CEC8000-memory.dmp

          Filesize

          96KB

        • memory/616-81-0x000000000CE90000-0x000000000CEA8000-memory.dmp

          Filesize

          96KB

        • memory/616-76-0x000000000CE70000-0x000000000CE88000-memory.dmp

          Filesize

          96KB

        • memory/616-71-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/640-55-0x0000000013140000-0x000000001317E000-memory.dmp

          Filesize

          248KB

        • memory/640-65-0x0000000013140000-0x000000001317E000-memory.dmp

          Filesize

          248KB

        • memory/640-50-0x0000000000400000-0x0000000000489000-memory.dmp

          Filesize

          548KB

        • memory/640-54-0x0000000017180000-0x0000000017187000-memory.dmp

          Filesize

          28KB

        • memory/2328-48-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2328-31-0x0000000000400000-0x000000000044C000-memory.dmp

          Filesize

          304KB

        • memory/2328-39-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2328-32-0x0000000017180000-0x000000001718C000-memory.dmp

          Filesize

          48KB

        • memory/2328-2989-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2904-59-0x0000000017180000-0x0000000017189000-memory.dmp

          Filesize

          36KB

        • memory/2904-58-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/2904-61-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

        • memory/2904-3745-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

        • memory/4884-0-0x0000000000400000-0x000000000047B000-memory.dmp

          Filesize

          492KB

        • memory/4884-2-0x0000000017180000-0x00000000171BB000-memory.dmp

          Filesize

          236KB

        • memory/4884-3-0x0000000000400000-0x000000000043B000-memory.dmp

          Filesize

          236KB

        • memory/4884-63-0x0000000000400000-0x000000000043B000-memory.dmp

          Filesize

          236KB