Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 14:40

General

  • Target

    4a1b278e22d8bacdb0764a0ef68fa44e_JaffaCakes118.exe

  • Size

    784KB

  • MD5

    4a1b278e22d8bacdb0764a0ef68fa44e

  • SHA1

    9d638697c5c1426295e7013e29da5da9fd7b6e08

  • SHA256

    7ddeb263d000da9cdad7f64b0fa20eaa6e49452da2c58231cc1f5d1b2075346c

  • SHA512

    ebf3bdefe5c17dc65fa227194c5392f381f76a2a9f13d4a79c9bbbdafd886f2ab870599e35e68c3299920b6d91b8459053f5151c463f84a10c338b2f8df24c87

  • SSDEEP

    12288:6DvpRBk2lTLqzEPlnvHeASzmR1CXEtwroAOCCE3VkxBH8Y1tz2wASRvBmL9c0zJU:KYARvBAcwioRS

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ranuranuwcs

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a1b278e22d8bacdb0764a0ef68fa44e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4a1b278e22d8bacdb0764a0ef68fa44e_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\yrUqgjjt.exe.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\yrUqgjjt.exe.exe"
      2⤵
      • Modifies visibility of file extensions in Explorer
      • UAC bypass
      • Boot or Logon Autostart Execution: Active Setup
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:724
      • C:\Users\Admin\AppData\Roaming\Local\Microsoft\CurrentVersion\UAC.exe
        "C:\Users\Admin\AppData\Roaming\Local\Microsoft\CurrentVersion\UAC.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1744
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\firewall.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\firewall.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\firewall.exe

    Filesize

    24KB

    MD5

    8e79606214833e936eb4b95726e465de

    SHA1

    1d7f3a3ab9864a21bad022be19fb3e8040ec43fd

    SHA256

    84e95480da9f5b3b7de59a5c3f9c1d024c8e195a9e9cb9321782c42a249f1902

    SHA512

    5671b5ea726759784ccfb5964a771b4cd7b2a9d5ee950bc91ec1457998ef0395e555919be2952c518e9be5bce3b8ef6c112dcbc8205adfc0c82698e6143c58f9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\yrUqgjjt.exe.exe

    Filesize

    278KB

    MD5

    2a40b4e01ffba72885bd4aa3a9cd0dbd

    SHA1

    2213b473bef30e87d367c68e951a412e2e03ee46

    SHA256

    1cb99c23c9a8f386315a4defcde54e12d8a29c00c941b524316fbac53e444362

    SHA512

    52ce21bf22f46c5d4e2e17e3b0deb339a7e0a58bdaad554c1be66b9aa2c4ae8a800518aaa22dd16346598d9dad80f9f7239c073a0b5c7bd6f3e8fce6aa1cb392

  • memory/724-17-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

    Filesize

    9.6MB

  • memory/724-20-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

    Filesize

    9.6MB

  • memory/724-60-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

    Filesize

    9.6MB

  • memory/724-56-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

    Filesize

    9.6MB

  • memory/724-18-0x000000001B6B0000-0x000000001BB7E000-memory.dmp

    Filesize

    4.8MB

  • memory/724-55-0x0000000020E60000-0x0000000020EC2000-memory.dmp

    Filesize

    392KB

  • memory/724-19-0x000000001B080000-0x000000001B11C000-memory.dmp

    Filesize

    624KB

  • memory/724-49-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

    Filesize

    9.6MB

  • memory/724-21-0x000000001B120000-0x000000001B128000-memory.dmp

    Filesize

    32KB

  • memory/724-22-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

    Filesize

    9.6MB

  • memory/724-23-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

    Filesize

    9.6MB

  • memory/724-39-0x000000001F200000-0x000000001F50E000-memory.dmp

    Filesize

    3.1MB

  • memory/724-40-0x000000001BE70000-0x000000001BE82000-memory.dmp

    Filesize

    72KB

  • memory/724-52-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

    Filesize

    9.6MB

  • memory/724-48-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

    Filesize

    9.6MB

  • memory/2824-16-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

    Filesize

    9.6MB

  • memory/2824-1-0x000000001B190000-0x000000001B236000-memory.dmp

    Filesize

    664KB

  • memory/2824-3-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

    Filesize

    9.6MB

  • memory/2824-0-0x00007FFC18C55000-0x00007FFC18C56000-memory.dmp

    Filesize

    4KB

  • memory/2824-15-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

    Filesize

    9.6MB