Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    14/07/2024, 02:01

General

  • Target

    43d963bb3d6d59917024fbcd50eebaac_JaffaCakes118.exe

  • Size

    4.7MB

  • MD5

    43d963bb3d6d59917024fbcd50eebaac

  • SHA1

    848a6799540049d5054bd4a9d43521cdcfbf2ea8

  • SHA256

    d2cd99f2ffcad6cc11d3798ad269c5a711ac9a9bd445e940df99b65d8b095d4b

  • SHA512

    efef3abf5c0106b2278fe8701e77a5fdf5aa02da979f70379240d07df3763de84244a1376c958c0773404201b122952dfc9a8b8cf97898c35ee88c6c3dc946c0

  • SSDEEP

    98304:i/W8zYD3JB9+RdcrhzBNmG5DFzD2DhLJFg4mYfU93YjIPR4t263ez3xQiqAQ7BS:i//E3JBsRdmzBAu+gE+RJ2xvFI

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43d963bb3d6d59917024fbcd50eebaac_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\43d963bb3d6d59917024fbcd50eebaac_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Program Files (x86)\Youdao\Dict\YodaoDict.exe
      "C:\Program Files (x86)\Youdao\Dict\YodaoDict.exe" install
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" "C:\Program Files (x86)\Youdao\Dict\YoudaoGetWord32.dll" /s
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:2236
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" "C:\Program Files (x86)\Youdao\Dict\YoudaoGetWord64.dll" /s
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1992
        • C:\Windows\system32\regsvr32.exe
          "C:\Program Files (x86)\Youdao\Dict\YoudaoGetWord64.dll" /s
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1460
    • C:\Program Files (x86)\Youdao\Dict\YodaoDict.exe
      "C:\Program Files (x86)\Youdao\Dict\YodaoDict.exe" instreport
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1208

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Youdao\Dict\YodaoDict.api

    Filesize

    176KB

    MD5

    f644fd525eb7a16842963458f95a8f24

    SHA1

    9fd9bad66fd39348dbb1faa58b8e3841663acdb4

    SHA256

    378c1de993cbb32e9cf8663b1c20986733da5e8755649eac1dee2938332fc319

    SHA512

    0436cd4a2302953900e2a5799f1585682f22f39cce54bc0e9ff9a48338056ba3853af04bdc6ae8c4304305ff70d4a094723188da197cca25b66ef9404fe3c0a9

  • C:\Program Files (x86)\Youdao\Dict\YoudaoGetWord32.dll

    Filesize

    301KB

    MD5

    defdfacb94569297bd74cdce30d014f1

    SHA1

    29424c26e644dd97b345d7c91b025a65d93d6605

    SHA256

    7a0fc662db1894071eb3a2b83e0d8c9f00b7ef2604b7aa903ba44f51ced452b1

    SHA512

    d4e4e37763628bd7757cfa23a88b1cb5cac77c2d89eb8a3030de535203a2e6a3da1b2a1fd4cf7bd183f48cdaa24ad19f1c754da11d83be966f94c3eae73ca6fe

  • C:\Program Files (x86)\Youdao\Dict\YoudaoGetWord64.dll

    Filesize

    481KB

    MD5

    7e12d51099017eafdf2b7626c514dce4

    SHA1

    f84a8c654e2ec5e080cea767a44a2d2a803c1e66

    SHA256

    0114d12aae2ebbfabda09a8e02a1bcffb91e4dce863c1c86b4668436aee50f57

    SHA512

    c85df7920f76a750af966067a16cafd5acd4fdf2f2514824ad4fa8d7d1bfc487eece0d735c2bb4da685a26d12b383f9f4598e72c17e7dad9a316fccbc1ddedd8

  • C:\Program Files (x86)\Youdao\Dict\default_config.ini

    Filesize

    77B

    MD5

    4d0f73ef439be3e82ed8f0b1ec9f34fc

    SHA1

    7e41c414369b51e8d846d0c6e701c4f393a18a78

    SHA256

    0408a6c40b7e3793a49510bad89c1ca52d906aafad5f27064223ebec4a4f5f5b

    SHA512

    3103b11966f389a6d5537be4ae7d37be9a131b27b0958f76948b09b0bf972db6dbdfa91ccd7e5c9ef3fcbacda41e0f42e4b1c04557e2f33cd08274fd324f5e93

  • C:\Program Files (x86)\Youdao\Dict\guid.dat

    Filesize

    16B

    MD5

    197db01a182166197d319e0738250013

    SHA1

    687e8e97f574d80eac0403034b33b8cdd24dfd81

    SHA256

    d5a06a989ca5f879dc9b7f91f2a243b6e05dd265be6be783b7e904fe766fe50f

    SHA512

    9afff9424d9aa8751a470090ff2d1406798d9553d38b9f282ac571d9f83379e3b5ab422749884687d3fee9bb52c48c9908bc95717858093a21753f617ae6e84c

  • C:\Program Files (x86)\Youdao\Dict\skins\xp-cute.bmp

    Filesize

    549KB

    MD5

    2055451ef343ddf16e3381af30ce836d

    SHA1

    c0ff6dd53d6664e05407b72bf725f7837c7e8394

    SHA256

    42b9c7089e17be21d5c8441ec8600b2d93627be08f6fe19081c08af7bbc8ba69

    SHA512

    da250349668c97305612d7658bc86f7d726507f287396813f452cc127e8fe7017524d4dc518e87d630adf44d3f60509d154b6585b763c3eae914b70cd4a682bc

  • C:\Program Files (x86)\Youdao\Dict\vendor.dat

    Filesize

    4B

    MD5

    e11ce15ad01f5fef87016b607ea74a1b

    SHA1

    e212d05d3aebab836c32bc247a0f325e96dc17d9

    SHA256

    146d7002ea6e76a5f6296cb7f8c1152e33e2f29903711fd7c997768a1ba2628b

    SHA512

    9c4c0c7ef9e62bf4656edd61f69dd4aa317365ee692191030cab99ea396f37a964f38990adda328710f8b245ce1f9bef2e1abfc170782a0c2b06e5c7320e9023

  • C:\Users\Admin\AppData\Local\Yodao\DeskDict\config.ini

    Filesize

    828B

    MD5

    0e1fe243c0d3726868770e998415118b

    SHA1

    058df77e26b67704d67834c78f0f82a80fb053dc

    SHA256

    02eeef10b4523bef247ac07e0d4a2a0470a9c2e307225532bdff17d987111c3e

    SHA512

    558ce7ab6acfe49032206b00684d015e399805ff2b8efcdd84aa7e3bcd2a69ad01a8b703d5d8ca290831dd0fbb628abc190d1aaddcf2723f7342741e868b144d

  • C:\Users\Admin\AppData\Local\Yodao\DeskDict\config.ini

    Filesize

    954B

    MD5

    26093b98a4cf7eba54956b6ff78b1e7d

    SHA1

    03158c1fab1fc09b12a3af6a2d81eeb50c6531dc

    SHA256

    da55620095fbef0f2726a844dbb3f8759240926d939ee57d897f83783b9b6149

    SHA512

    65271f5a264eea5ac3035c6aa2f9d6ba5a7a6b8947ae57f268c0abf8d1a73e498a9179e41aad6e223c619e52883872fc0f45bfd65241897449d7cd4b8fb83148

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9

    Filesize

    1KB

    MD5

    ba4e3f44b19e926525ab37f65b33a5e1

    SHA1

    d30b326297672f3e74a2e6f6bad42e7d79cc91f0

    SHA256

    9e23b893746ba984eadc822da78bce02121236d2779101c66ac0d622f0c07e5d

    SHA512

    1bd49e6ff7b018c3bbe1e61d6c5df05924d7a3eda1e897cfca318ea71e5292ae62e427cf233d99415e289170624df2b5a73fec105be2e52786f1570d79af3d7d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\yodaodictproxyuser

    Filesize

    152B

    MD5

    e036a52181d9614b2ffa05bdf43433af

    SHA1

    7ad1badf149282ae7168b531fd5f8afd7fdd8471

    SHA256

    4d029c6d6901fcca513e4fa6dc76ebc67a28022ff669434d007adf032521c11b

    SHA512

    c2a9c2a96419fcb1fe7da1c3d8dcc68ea34ce78c7320e49156e276e8f2d0fc644e66ee91e5b24eeaf3d7dd1d4361c5b8363a52f21ac4e8f2bc1da2bdfac27f4f

  • \Program Files (x86)\Youdao\Dict\WordBook.exe

    Filesize

    1.0MB

    MD5

    8f53c2d99bfa673b55166bcf1ff7d7da

    SHA1

    926c2a8973e865e97bc8efd2853fe452baf1de9a

    SHA256

    3c427a32b5f6d01035fbf6ef41e24cec36dbd6bdf2623e92415b3db38cf29c7d

    SHA512

    06eea32886ed3b710c7ec794296c7cb7aadb82cf8e6efd24e4c7e3441dc32ae17a56b169df5763988ef77cc392e4e54e95abbe89e8886c3450bb0957c82e589e

  • \Program Files (x86)\Youdao\Dict\YodaoDict.exe

    Filesize

    1.6MB

    MD5

    c7ed7d11c78afcff633ad5109445820f

    SHA1

    fac007401a37d621f32c4ee7e426c153dc12203e

    SHA256

    99c01ecce6c52ab30736b74c4fd519298b133125b7c2b2c0926763d0f471818a

    SHA512

    e4ff7760844dbb0c284c7d200eaf95520c7291e6a932289d5b098521e4b759ae4d44390c0dd59b039a8111e892a11872f70f6839126fd3d93e7c4790130d9061