Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 16:13

General

  • Target

    22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe

  • Size

    169KB

  • MD5

    22ff1acf1a6c7ecafdb0d5a686e457d6

  • SHA1

    bb8e192ab0e2efedf6d3cc8c9744690c0e26ff5f

  • SHA256

    da1ff72421209a3df6153b87b27f7e1a24e9ad6d2c2cb990fb51bce1cd1c4c9c

  • SHA512

    6f120002ced4ef2fb93e91853660fec44ebc6643d6f29a60cd1524cb9a2ba9560538fef9d822c3207728bac7a148f495e1926f3649e33fbf36d48f637af9afa8

  • SSDEEP

    3072:XbUsNSk+dpN2goBw69Non3iXMtvWJqRAq5e7G7VO8rhJZz2UXEvEr9RGBkuu46:AvjN2rnSyXYWf7+VOqh1XEvE9RF46

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 2 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\22ff1acf1a6c7ecafdb0d5a686e457d6_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3752
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 280
      2⤵
      • Program crash
      PID:3080
    • C:\Recycle.Bin\B6232F3AFB2.exe
      "C:\Recycle.Bin\B6232F3AFB2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3024
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 280
        3⤵
        • Program crash
        PID:3248
      • C:\Users\Admin\AppData\Local\Temp\0fiF760.exe
        "C:\Users\Admin\AppData\Local\Temp\0fiF760.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4348
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3752 -ip 3752
    1⤵
      PID:4872
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3024 -ip 3024
      1⤵
        PID:4480
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:8
        1⤵
          PID:3116

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Recycle.Bin\B6232F3AFB2.exe

          Filesize

          169KB

          MD5

          22ff1acf1a6c7ecafdb0d5a686e457d6

          SHA1

          bb8e192ab0e2efedf6d3cc8c9744690c0e26ff5f

          SHA256

          da1ff72421209a3df6153b87b27f7e1a24e9ad6d2c2cb990fb51bce1cd1c4c9c

          SHA512

          6f120002ced4ef2fb93e91853660fec44ebc6643d6f29a60cd1524cb9a2ba9560538fef9d822c3207728bac7a148f495e1926f3649e33fbf36d48f637af9afa8

        • C:\Recycle.Bin\BAA372DC42F69AE

          Filesize

          9KB

          MD5

          a684fffd28414e1d28837adce0f8aac1

          SHA1

          d0c391c7064d1343288edae77cde798635585145

          SHA256

          f341c79fbeb18b9790c73c45672af6d822705042c59699e72e7e90a37c6077bc

          SHA512

          233dc56d1738ac7f118d087607395a0e8bfd9280ed1a005dda4cf95137983b2d426ad91d9bc89932f15d86fd3be4c7c25b2577e7012518e956a598f08e8b4dc1

        • C:\Users\Admin\AppData\Local\Temp\0fiF760.exe

          Filesize

          3KB

          MD5

          29090b6b4d6605a97ac760d06436ac2d

          SHA1

          d929d3389642e52bae5ad8512293c9c4d3e4fab5

          SHA256

          98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

          SHA512

          9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

        • memory/3024-12-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

        • memory/3024-14-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

        • memory/3024-23-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

        • memory/3024-13-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

        • memory/3752-84-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/3752-87-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/3752-10-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

        • memory/3752-80-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/3752-86-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/3752-81-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/3752-3-0x0000000002190000-0x0000000002191000-memory.dmp

          Filesize

          4KB

        • memory/3752-2-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

        • memory/3752-82-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/3752-4-0x0000000002190000-0x0000000002191000-memory.dmp

          Filesize

          4KB

        • memory/3752-85-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/3752-0-0x0000000002070000-0x0000000002074000-memory.dmp

          Filesize

          16KB

        • memory/3752-88-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/3752-89-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/3752-90-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/3752-91-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/3752-83-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/3752-75-0x0000000002070000-0x0000000002074000-memory.dmp

          Filesize

          16KB

        • memory/3752-76-0x0000000077522000-0x0000000077524000-memory.dmp

          Filesize

          8KB

        • memory/3752-77-0x00000000021A0000-0x00000000021A1000-memory.dmp

          Filesize

          4KB

        • memory/3752-1-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

        • memory/3752-74-0x00000000021A0000-0x00000000021A1000-memory.dmp

          Filesize

          4KB

        • memory/4348-55-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-33-0x00000000023E0000-0x000000000242E000-memory.dmp

          Filesize

          312KB

        • memory/4348-59-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-58-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-57-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-56-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-62-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-54-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-63-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-53-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-52-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-50-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-49-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-48-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-47-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-46-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-45-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-44-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-43-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-42-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-51-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-40-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-35-0x00000000023E0000-0x000000000242E000-memory.dmp

          Filesize

          312KB

        • memory/4348-60-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-32-0x00000000023E0000-0x000000000242E000-memory.dmp

          Filesize

          312KB

        • memory/4348-64-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-29-0x00000000023E0000-0x000000000242E000-memory.dmp

          Filesize

          312KB

        • memory/4348-67-0x00000000023E0000-0x000000000242E000-memory.dmp

          Filesize

          312KB

        • memory/4348-68-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-70-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-71-0x00000000023E0000-0x000000000242E000-memory.dmp

          Filesize

          312KB

        • memory/4348-66-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-61-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-105-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB

        • memory/4348-41-0x0000000001000000-0x0000000001004000-memory.dmp

          Filesize

          16KB

        • memory/4348-36-0x0000000000ED0000-0x0000000000ED6000-memory.dmp

          Filesize

          24KB

        • memory/4348-34-0x00000000023E0000-0x000000000242E000-memory.dmp

          Filesize

          312KB

        • memory/4348-28-0x00000000023E0000-0x000000000242E000-memory.dmp

          Filesize

          312KB

        • memory/4348-31-0x00000000023E0000-0x000000000242E000-memory.dmp

          Filesize

          312KB

        • memory/4348-19-0x00000000023E0000-0x000000000242E000-memory.dmp

          Filesize

          312KB

        • memory/4348-24-0x00000000023E0000-0x000000000242E000-memory.dmp

          Filesize

          312KB

        • memory/4348-27-0x00000000023E0000-0x000000000242E000-memory.dmp

          Filesize

          312KB

        • memory/4348-25-0x0000000001001000-0x0000000001002000-memory.dmp

          Filesize

          4KB

        • memory/4348-111-0x00000000750FB000-0x00000000750FD000-memory.dmp

          Filesize

          8KB

        • memory/4348-118-0x00000000023E0000-0x000000000242E000-memory.dmp

          Filesize

          312KB

        • memory/4348-120-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

          Filesize

          312KB