Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 01:49

General

  • Target

    47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe

  • Size

    844KB

  • MD5

    47b787fefce21508ef8408e9f404267d

  • SHA1

    61ac910a258eddab027f27eb5cacb9b66f20fcf5

  • SHA256

    5554b40aa6810e1c6f720ab2f90c216c08a95e864666c81313ec44dbdee76d52

  • SHA512

    36103a07604c3f355a9834ad2d1008f2e54a88941970e2f37a57548564bb7d1fa58fd7cb8f0e22003e9e3c5e5678a8881fe3dcfe9d10e793379637ecd088f60b

  • SSDEEP

    24576:lOZUrs2MwgQgyVAXPK3J/6ZcTxIIuTdj1xsLCi:LPVl/6STxIIadTsL7

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 10 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\47b787fefce21508ef8408e9f404267d_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4620
      • C:\Windows\SysWOW64\wscript.exe
        wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\java2.bat
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:3892
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java2.bat" "
          4⤵
          • Drops startup file
          PID:3872
    • C:\Windows\Temp\svchost.exe
      C:\Windows\Temp\svchost.exe
      2⤵
        PID:4764
      • C:\Windows\Temp\svchost.exe
        C:\Windows\Temp\svchost.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3692
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3256
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            4⤵
            • Modifies firewall policy service
            • Modifies registry key
            PID:964
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\svchost.exe" /t REG_SZ /d "C:\Windows\Temp\svchost.exe:*:Enabled:Windows Messanger" /f
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3012
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\svchost.exe" /t REG_SZ /d "C:\Windows\Temp\svchost.exe:*:Enabled:Windows Messanger" /f
            4⤵
            • Modifies firewall policy service
            • Modifies registry key
            PID:1740
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:624
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            4⤵
            • Modifies firewall policy service
            • Modifies registry key
            PID:2256
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\D5ECXYPCM1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\D5ECXYPCM1.exe:*:Enabled:Windows Messanger" /f
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1292
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\D5ECXYPCM1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\D5ECXYPCM1.exe:*:Enabled:Windows Messanger" /f
            4⤵
            • Modifies firewall policy service
            • Modifies registry key
            PID:2680
      • C:\Windows\Temp\svchost.exe
        C:\Windows\Temp\svchost.exe
        2⤵
          PID:2264
        • C:\Windows\Temp\svchost.exe
          C:\Windows\Temp\svchost.exe
          2⤵
            PID:864

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\invs.vbs

          Filesize

          78B

          MD5

          c578d9653b22800c3eb6b6a51219bbb8

          SHA1

          a97aa251901bbe179a48dbc7a0c1872e163b1f2d

          SHA256

          20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

          SHA512

          3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

        • C:\Users\Admin\AppData\Local\Temp\java.bat

          Filesize

          47B

          MD5

          81bf5400486e5da45ba0c6c1399d843f

          SHA1

          d70a7c4d3f3057a3ef5b8b1c764b40b3d3b4d59d

          SHA256

          d1a915a5e0286b1648a6e094f52813e2b5766dce3acf6342b297f7ca113545f1

          SHA512

          ebeee9eb5249ee1b278bf6c1fbcd91e4c073a241203f218dfa2edfa708a37679c6e6a78751de55b4640a024b32ce4389bd5d931401309163950cd15b4a91c140

        • C:\Users\Admin\AppData\Local\Temp\java2.bat

          Filesize

          151B

          MD5

          ed28c618f7d8306e3736432b58bb5d27

          SHA1

          441e6dab70e31d9c599fcd9e2d32009038781b42

          SHA256

          d9aa03911260779b1f8a9b046a7ecf7aa87b0f13c762491fe8e06c482bac09a3

          SHA512

          4257d8839e881a9ab6de6230a9df1e81456cb796eb9ee2361789fa5fe4c81b297ed1c472f91d97bb0b2ebdb6acadb924617e6ffd32fc96d8ddcebf8fee4a7880

        • C:\Users\Admin\AppData\Local\Temp\rundll32-.txt

          Filesize

          844KB

          MD5

          47b787fefce21508ef8408e9f404267d

          SHA1

          61ac910a258eddab027f27eb5cacb9b66f20fcf5

          SHA256

          5554b40aa6810e1c6f720ab2f90c216c08a95e864666c81313ec44dbdee76d52

          SHA512

          36103a07604c3f355a9834ad2d1008f2e54a88941970e2f37a57548564bb7d1fa58fd7cb8f0e22003e9e3c5e5678a8881fe3dcfe9d10e793379637ecd088f60b

        • C:\Windows\Temp\svchost.exe

          Filesize

          1.1MB

          MD5

          d881de17aa8f2e2c08cbb7b265f928f9

          SHA1

          08936aebc87decf0af6e8eada191062b5e65ac2a

          SHA256

          b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

          SHA512

          5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

        • memory/1048-1-0x0000000075480000-0x0000000075A31000-memory.dmp

          Filesize

          5.7MB

        • memory/1048-2-0x0000000075480000-0x0000000075A31000-memory.dmp

          Filesize

          5.7MB

        • memory/1048-38-0x0000000075480000-0x0000000075A31000-memory.dmp

          Filesize

          5.7MB

        • memory/1048-0-0x0000000075482000-0x0000000075483000-memory.dmp

          Filesize

          4KB

        • memory/3692-35-0x0000000000400000-0x0000000000470000-memory.dmp

          Filesize

          448KB

        • memory/3692-22-0x0000000000400000-0x0000000000470000-memory.dmp

          Filesize

          448KB

        • memory/3692-17-0x0000000000400000-0x0000000000470000-memory.dmp

          Filesize

          448KB

        • memory/3692-39-0x0000000000400000-0x0000000000470000-memory.dmp

          Filesize

          448KB

        • memory/3692-41-0x0000000000400000-0x0000000000470000-memory.dmp

          Filesize

          448KB

        • memory/3692-43-0x0000000000400000-0x0000000000470000-memory.dmp

          Filesize

          448KB

        • memory/3692-45-0x0000000000400000-0x0000000000470000-memory.dmp

          Filesize

          448KB

        • memory/3692-47-0x0000000000400000-0x0000000000470000-memory.dmp

          Filesize

          448KB

        • memory/3692-50-0x0000000000400000-0x0000000000470000-memory.dmp

          Filesize

          448KB

        • memory/3692-51-0x0000000000400000-0x0000000000470000-memory.dmp

          Filesize

          448KB

        • memory/3692-53-0x0000000000400000-0x0000000000470000-memory.dmp

          Filesize

          448KB

        • memory/3692-55-0x0000000000400000-0x0000000000470000-memory.dmp

          Filesize

          448KB