Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 14:13

General

  • Target

    420510492da636173cac57ceca9ba4bd_JaffaCakes118.exe

  • Size

    1.7MB

  • MD5

    420510492da636173cac57ceca9ba4bd

  • SHA1

    c0e83c3f0f9af57e7dfaf3ff1dfe436a6a9367b1

  • SHA256

    0a2aef9dec40e1004eec08ff11a1352002f2b94347bf148646231e440cb24418

  • SHA512

    23990416890db0f26bdca3a5eb80c7d5f040acc880d3c738314e0f8651012b1b4a076dde89efde6d5b3d31bda7eb7e55d70ff7de85b257a9bd4850e50d1d5be5

  • SSDEEP

    24576:mQo4NHcCafRyWIu7XoqygBAy7v3d+fNAZz2yJrg8X589PGcOH0H3cY+v:v+Cc/sqygBAy7FyScYrgg589NA0Q

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 45 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\420510492da636173cac57ceca9ba4bd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\420510492da636173cac57ceca9ba4bd_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\isass.exe
      "C:\Users\Admin\AppData\Local\isass.exe"
      2⤵
      • Executes dropped EXE
      PID:3032
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\check.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V regsrvc /D "\"C:\Users\Admin\AppData\Local\isass.exe\"" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V regsrvc /D "\"C:\Users\Admin\AppData\Local\isass.exe\"" /f
          4⤵
          • Adds policy Run key to start application
          • Modifies registry key
          PID:2664
    • C:\Users\Admin\AppData\Local\ko2fuckoff.exe
      "C:\Users\Admin\AppData\Local\ko2fuckoff.exe"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:284
      • C:\Windows\System32\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s Data\Lib\Func.dll
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2612
        • C:\Windows\SysWOW64\regsvr32.exe
          /s Data\Lib\Func.dll
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:2692
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\check.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V regsrvc /D "\"C:\Users\Admin\AppData\Local\isass.exe\"" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1804
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V regsrvc /D "\"C:\Users\Admin\AppData\Local\isass.exe\"" /f
          4⤵
          • Adds policy Run key to start application
          • Modifies registry key
          PID:2936
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\check.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V regsrvc /D "\"C:\Users\Admin\AppData\Local\isass.exe\"" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V regsrvc /D "\"C:\Users\Admin\AppData\Local\isass.exe\"" /f
          4⤵
          • Adds policy Run key to start application
          • Modifies registry key
          PID:2928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Data\Lib\Func.dll

    Filesize

    24KB

    MD5

    18f1b9ee7028d06927793a7bef775042

    SHA1

    5a5d77d37039f87bad9a12b1502cc7d6885a4bd3

    SHA256

    e58deb81e9f780d8366610d85561a6cbb8af4ac64f2925089039ccaee4bcad83

    SHA512

    f58cb86bb773b2c2db5431bc6298b04f9b420ffb396648427029bdccd21f4bfcac5367149c123f00211adabde9b29dcacc3dce2d8682f41b45182b9c9fdf65e5

  • C:\Users\Admin\AppData\Local\Temp\check.bat

    Filesize

    162B

    MD5

    1fe82309aa71db17b512cd0e70abf24e

    SHA1

    de388174e708108cde672d8f93fb756614b8ee93

    SHA256

    0a8129d9351f146392e0e2bf88f024b113d47524d13db9cd1a905a73d94f6b99

    SHA512

    c125fa0e846fd30d889999726e39c312579a79cf0852984aa66e27f8897ea1a6c12125f655b524e89d165a060d988bb049241b7cea444236f0475045d5b79d32

  • C:\Users\Admin\AppData\Local\ko2fuckoff.exe

    Filesize

    1.2MB

    MD5

    806b2ec01dce55188b8dc6913052a25e

    SHA1

    40e83d827b602010b4abc0999c1369ada0be1aa6

    SHA256

    94584229ecc80c82b6841d446beb9dcc1c043393d8f5dd34cd585e9080f24aa5

    SHA512

    46d8df3f7f4286a59f3c9ae22ab8918b9f3427607cb8c2974a302d362f4a157357b98e477426984f633492f2936d7ac939983f89d59d08f5dbfe389c070cd136

  • \Users\Admin\AppData\Local\isass.exe

    Filesize

    169KB

    MD5

    9611984959f46af1b44f16675293df38

    SHA1

    be4f8bb96d1e5b289a327b01773acd145dd6dd7b

    SHA256

    1db63137e0f2a371925c8d378fd48c8471a6cb9ea7db4f0ae249894d65af4b13

    SHA512

    06b7ef16c46b9295b7a8fb9dd36b1cca18b2b31c15521a5235071cc3cd3fe95824ef3d22aa5eb686cb1cd3041b399d0edbd82f3b7ed4eb63a8354c0f1ceed12a

  • memory/3024-41-0x0000000000400000-0x00000000005C2000-memory.dmp

    Filesize

    1.8MB

  • memory/3032-68-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB