Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
12/07/2024, 05:41
General
-
Target
3c2df1a6b07c9653d6096d7848987e1f_JaffaCakes118.exe
-
Size
165KB
-
MD5
3c2df1a6b07c9653d6096d7848987e1f
-
SHA1
07992d239c5e69cfe2a6a909140943924f415575
-
SHA256
63a90c1fb09d01eb9e306f152d129e57d27092c63f0a6b08360d60bcfba9fb8e
-
SHA512
3addbaade61eed7f3f0d96fa1f888be55f10d180e43ff1e357be7ec3d7b7da175532ecf87a175339d4878dbac86107a5753fb99032bbb4771cd6327696b4dd8e
-
SSDEEP
3072:lybEQ/OLsU5zSBk6hPWIwb1GOXCAORUwNNFBJfqy:+/OLsvk60GOSTTbj
Malware Config
Extracted
Protocol: smtp- Host:
Smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
19971020k
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c2df1a6b07c9653d6096d7848987e1f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c2df1a6b07c9653d6096d7848987e1f_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Microsoftlog.exe"C:\Users\Admin\AppData\Local\Temp\Microsoftlog.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD51f5200c4744dc14545459a89654c58d1
SHA12703232ecad2953736f855fe1dc76ad3ee45578c
SHA256dc166d945fcc6e0babb9b89838fc1f613c35caffa1b9b39a50828ce89a638297
SHA512e802ac4ac42d98db86422eb9e2b0f4814b471eec8eb63d5f55286a0575ee9d9918c06bcd846bca26b9c8715923a9f6f63305f13b40bbe603a5ba47ba17c86557
-
Filesize
8KB
MD54d517db9b0a1dd7ff83e53b29797f772
SHA1fc9f5d50e68fd776a9821eddea7bed3f907c5e05
SHA256f8182bd4b4394e9e92af9d56513293230d607cb6261bd055709ec8bf559e7cf2
SHA512b35ef34b411e9aeeca9979fd0e92aa97eecfed4984fdf66236aa751baf8412515282e507e6ca7b74b998f0ebd58393bee761de502ee2a98362bcdde59e13128b
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
392KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
3.1MB
-
Filesize
9.6MB
-
Filesize
304KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB