Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

406330f4ab...18.exe

windows7-x64

8

406330f4ab...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 05:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    406330f4abd0aff45ebc657b5b37560c_JaffaCakes118.exe

  • Size

    68KB

  • MD5

    406330f4abd0aff45ebc657b5b37560c

  • SHA1

    7b38374a0bd219475158941d004dc055a44fd28c

  • SHA256

    44f53e2ca552f49ce5803a4139e09957c14422cfbc7e6ee5df445e16e4b2c4ce

  • SHA512

    36c7541442d8cd902a9e775b58b43cab90132f04a1067a9b5ae94ec7b11b9a1fef20bca709237a79bb22c460da90118605eae592dcb08d610d9b436d311193cc

  • SSDEEP

    1536:cj+x2UHc9nMXoML9atF9mV78oe1jDzeDCrqo/11s:bpaTQaw8ACr11s

Score
8/10
evasionexecutionpersistencetrojan

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\406330f4abd0aff45ebc657b5b37560c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\406330f4abd0aff45ebc657b5b37560c_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Program Files\YORZ5D9.exe
      "C:\Program Files\YORZ5D9.exe" C:\Users\Admin\AppData\Local\Temp\406330f4abd0aff45ebc657b5b37560c_JaffaCakes118.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      PID:4384
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 620
        3⤵
        • Program crash
        PID:4948
    • C:\Program Files\YORZ5D9.exe
      "C:\Program Files\YORZ5D9.exe" rb
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4936
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files\R19THVF24SB.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Windows\SysWOW64\sc.exe
        sc.exe create 2326CR78U1ZBinPath= "C:\Program Files\0GOQJ3\OKK47X.exe -start" type= own type= interact start= auto DisplayName= YRS4G
        3⤵
        • Launches sc.exe
        PID:2904
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /u /s shimgvw.dll
        3⤵
          PID:388
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /u /s itss.dll
          3⤵
            PID:3816
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /u /s scrrun.dll
            3⤵
            • Modifies registry class
            PID:2168
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /u /s vbscript.dll
            3⤵
              PID:628
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32.exe /s jscript.dll
              3⤵
              • Modifies registry class
              PID:2004
            • C:\Windows\SysWOW64\reg.exe
              reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F
              3⤵
              • Modifies Internet Explorer settings
              PID:2592
            • C:\Windows\SysWOW64\reg.exe
              reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Animations /t REG_SZ /d no /F
              3⤵
              • Modifies Internet Explorer settings
              PID:4576
            • C:\Windows\SysWOW64\reg.exe
              reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Videos" /t REG_SZ /d no /F
              3⤵
              • Modifies Internet Explorer settings
              PID:3132
            • C:\Windows\SysWOW64\reg.exe
              reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Images" /t REG_SZ /d yes /F
              3⤵
              • Modifies Internet Explorer settings
              PID:3948
            • C:\Windows\SysWOW64\reg.exe
              reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F
              3⤵
              • Modifies Internet Explorer settings
              PID:2988
            • C:\Windows\SysWOW64\reg.exe
              reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F
              3⤵
              • Modifies Internet Explorer settings
              PID:5096
            • C:\Windows\SysWOW64\reg.exe
              reg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
              3⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:4032
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4384 -ip 4384
          1⤵
            PID:3944

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\7-Zip\7zG.exe.com
            Filesize

            68KB

            MD5

            406330f4abd0aff45ebc657b5b37560c

            SHA1

            7b38374a0bd219475158941d004dc055a44fd28c

            SHA256

            44f53e2ca552f49ce5803a4139e09957c14422cfbc7e6ee5df445e16e4b2c4ce

            SHA512

            36c7541442d8cd902a9e775b58b43cab90132f04a1067a9b5ae94ec7b11b9a1fef20bca709237a79bb22c460da90118605eae592dcb08d610d9b436d311193cc

            Download Submit

          • C:\Program Files\R19THVF24SB.bat
            Filesize

            1KB

            MD5

            06cb4c722dae4e2bd9ccbf874072da7d

            SHA1

            bb2deb6002188bd270942cc1ef217f394e8a520b

            SHA256

            1c988358a9002eb4aa5f9b31b1460494a278c9b5fe0a5bcecfbd6c295566d391

            SHA512

            709b4d933affcbf99cfe28dc710166426b28013a5696cdf7a6be3fbbb79df33e4b03369ac998338efef5c02f44cfd4615b757b1cd2487534efeb3d704cb77eea

            Download Submit

          • C:\Program Files\YORZ5D9.exe
            Filesize

            28KB

            MD5

            16b931eb346d9ddd833cf9fb6f6fe829

            SHA1

            564d9d92ada66930d759645ed60c331bf6a20216

            SHA256

            dd8ef34c2a7048f2970da5ec121c13c491eb86e0c149e1b57f65fd84e488de40

            SHA512

            040afe83fd90d79b44cb9c535e993610d2de034e4c807443f7d77e0fd1ec950e8326b93338c868c1ef4f357d6835aff82064470c7b687b03c8895f3cdac91ae1

            Download Submit