Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2024, 18:15

General

  • Target

    2923741317a4e7ae4285060d6f0297f2_JaffaCakes118.exe

  • Size

    5.5MB

  • MD5

    2923741317a4e7ae4285060d6f0297f2

  • SHA1

    26870024a6780ea6b2433f36ddcbe302072f5b15

  • SHA256

    322e7d7d4245bbc92bf6ba22ed754ef2a7c7f5f9ffd206d874b186c5ef83482f

  • SHA512

    4a6cbff480babc2af58cdbd3e3d184a75d60501c4318906204dbdfb67c48f1ba14c1d9d7c33063945d6a3a13a87896a6f25be5b461c1a4e24d8dda27e56af337

  • SSDEEP

    98304:tzzsbbcV2VQ52AlFj6DN1ZwFvpQx/2gld9CX4qcezkw+B9dzOZh2TdgWPeQtc8QP:tzz+wt27DNniFglTC3ceAw+B9MZh2TKb

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 39 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2923741317a4e7ae4285060d6f0297f2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2923741317a4e7ae4285060d6f0297f2_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C taskkill /f /im "Funshion.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im "Funshion.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:184
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C taskkill /f /im "FSPServer.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4684
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im "FSPServer.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4884
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C taskkill /f /im "FunshionService.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3460
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im "FunshionService.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1508
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C taskkill /f /im "Updater.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3948
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im "Updater.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4172
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C taskkill /f /im "FunshionUpdate.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4960
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im "FunshionUpdate.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4436
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C taskkill /f /im "FunshionUpgrade.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4044
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im "FunshionUpgrade.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\getmacaddress.dll

    Filesize

    156KB

    MD5

    0fc4d42653fc43553b7dcb6ffe55d189

    SHA1

    49f4aac3f3fb089f310b7a526a5ab45d16d0dc0b

    SHA256

    e648ca2482f9e4bd7fffec2b80ab30adda424c26dae781bcb1760e384430cfc9

    SHA512

    603c759ee4b16c1d862a2a82814df939207c61120543b807821aba394ddc7ec9db228e19dbf09e8a26c439d9e1548154eadb7ec6d8757b4492e132fc47059546

  • C:\Users\Admin\AppData\Local\Temp\muiCB7E.tmp

    Filesize

    172KB

    MD5

    685f1cbd4af30a1d0c25f252d399a666

    SHA1

    6a1b978f5e6150b88c8634146f1406ed97d2f134

    SHA256

    0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

    SHA512

    6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

  • C:\Users\Admin\AppData\Local\Temp\nsxCC8B.tmp\ExecCmd.dll

    Filesize

    4KB

    MD5

    b9380b0bea8854fd9f93cc1fda0dfeac

    SHA1

    edb8d58074e098f7b5f0d158abedc7fc53638618

    SHA256

    1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244

    SHA512

    45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c

  • C:\Users\Admin\AppData\Local\Temp\nsxCC8B.tmp\FindProcDLL.dll

    Filesize

    31KB

    MD5

    83cd62eab980e3d64c131799608c8371

    SHA1

    5b57a6842a154997e31fab573c5754b358f5dd1c

    SHA256

    a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294

    SHA512

    91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

  • C:\Users\Admin\AppData\Local\Temp\nsxCC8B.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

  • C:\Users\Admin\AppData\Local\Temp\nsxCC8B.tmp\KillProcDLL.dll

    Filesize

    32KB

    MD5

    83142eac84475f4ca889c73f10d9c179

    SHA1

    dbe43c0de8ef881466bd74861b2e5b17598b5ce8

    SHA256

    ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

    SHA512

    1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

  • C:\Users\Admin\AppData\Local\Temp\nsxCC8B.tmp\NSISdl.dll

    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • C:\Users\Admin\AppData\Local\Temp\nsxCC8B.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • C:\Users\Admin\AppData\Local\Temp\nsxCC8B.tmp\WelcomePage.ini

    Filesize

    126B

    MD5

    35e4b01a17602245e12abbc306e3613a

    SHA1

    4624562000e4fc68b436adcddf6cae7db8d5cb8c

    SHA256

    b886699e29278b684f76da55532f1e31640bca631165eb664ded5e43cc79f7db

    SHA512

    1d846ba4cd93262e217dd937f18042c27875a31fed0751055c94111d16e475e795e77aa0023d2d29f5f476347ba97344d73ff7af17e42aabfc37246218ddc09e

  • C:\Users\Admin\AppData\Local\Temp\nsxCC8B.tmp\md5dll.dll

    Filesize

    8KB

    MD5

    a7d710e78711d5ab90e4792763241754

    SHA1

    f31cecd926c5d497aba163a17b75975ec34beb13

    SHA256

    9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2

    SHA512

    f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0

  • memory/4808-24-0x00000000007A0000-0x00000000007AB000-memory.dmp

    Filesize

    44KB

  • memory/4808-8-0x0000000002160000-0x00000000021D3000-memory.dmp

    Filesize

    460KB

  • memory/4808-129-0x0000000002680000-0x00000000026A8000-memory.dmp

    Filesize

    160KB

  • memory/4808-0-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/4808-7-0x0000000002160000-0x00000000021D3000-memory.dmp

    Filesize

    460KB

  • memory/4808-190-0x0000000002160000-0x00000000021D3000-memory.dmp

    Filesize

    460KB

  • memory/4808-192-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/4808-194-0x0000000002160000-0x00000000021D3000-memory.dmp

    Filesize

    460KB