Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 04:35

General

  • Target

    5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    5a7c5387f107ee6eea7c7debcd9d449f

  • SHA1

    392c1eed3a6b8e2209d975efc1fab5909db5adc2

  • SHA256

    1edd5a31230594d44488fe0a471031f3bf3cf8c5527dc60025a957b67f8a4b90

  • SHA512

    e1ac70690da971039a9aa319134aa6a40ef7d551872e38cd9487e921b0612eff1cb337fde875285ed3447c67e7a78fe4ac37bf39e073d3eec2285ebc112b49d1

  • SSDEEP

    24576:B2uFhCwUuqDluBMfEhJX3z5mKhwbLeoMX0j:dhxqDosEL3F/w+X2

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\smes\u.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\ProgramData\smes\smes.exe
        smes.exe -install
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3048
      • C:\ProgramData\smes\smes.exe
        smes.exe -start
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3968
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat"
      2⤵
        PID:4128
    • C:\ProgramData\smes\smes.exe
      C:\ProgramData\smes\smes.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2420
      • C:\ProgramData\smes\smes.exe
        C:\ProgramData\smes\smes.exe -run
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3828

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\kingsoft\kws\kws.ini

      Filesize

      720B

      MD5

      ffc3088dc68b14616fc334ce25f7c4ec

      SHA1

      83ea5e504ba582fd0db81371888b2d2d36012af8

      SHA256

      f39e009b78bbca138cf7ca72023390afe0e9ab1980eb0e326e637186a1249872

      SHA512

      b3c29e4513ba21d9588661eeffe029bdc5a2317cb3345cbe945f50df9688732d478e614e67a64f87d9cdf2c284eaeb9c497feef69ee71a621f4fc009bf1c09b4

    • C:\ProgramData\smes\KWSSVC.log

      Filesize

      448B

      MD5

      06fe5c01e88143dcfc884f2a7c46aac9

      SHA1

      8551a36daec50a30417f714e58c3bdb77ecfc3fb

      SHA256

      b3cd33839cede557be599cfb6435257c63aa718b8d783df8d39f2a8049e01672

      SHA512

      38fe849e0be5db5a976c079ceec0175cb9ca0f23c88a3c9ae238b2b2449373c3072dfe64086b760f45add3c323df2339138bd9bd383012cebfe629e237cd26e2

    • C:\ProgramData\smes\KWSSVC.log

      Filesize

      546B

      MD5

      992146248d982210299fa0134f5dd20b

      SHA1

      7aa9392c854096df2dc05507d29bf3b3cb78e516

      SHA256

      da20bc0b5b7f0daa05b35aa1019ebd74b760891dc9066789c703ebcc47f759bb

      SHA512

      71576abfae039c1148bbaf4be29cd2983b6c4b0cc252f8eb687c5e22d9dc9417a5883121a51b251edab79506a8b4d99550c5f92f9932026002e307a45aa336d7

    • C:\ProgramData\smes\kswebshield.dll

      Filesize

      441KB

      MD5

      7851449473178f9782263d51bc5e3bbc

      SHA1

      ad5148ee1bed2348b320c62c025d52fbcbb28799

      SHA256

      c3bc7ec8428f0bb210a0597c9a0cad1be412b7fa46ea006819a3df9ac23118b4

      SHA512

      b01fc37ac84b81df8d7657000295aed7eb50aaf7f13ab2b2be9030c9f83ed1559318c83c78b4a29926d7d30e9eea9538d123ef4a649179be5a5b54ee71ed9b49

    • C:\ProgramData\smes\kwssp.dll

      Filesize

      425KB

      MD5

      bf5dcfd9da0514334d41cbd80d2a9138

      SHA1

      802f9e0b82edca56be08a33b2ba874b34c31f1e3

      SHA256

      f9506cf9a87aa6bfbf07f2124f2785a711b27a70839ebb95bdd4b2cf747fb060

      SHA512

      246796f2e201cde30043eaa2c0ffb4d2b3bea2bae97261a022824c31a42d2b08998b1bdcd436e8392bdd153dd6fadf9ba69361c7316a6bfda5d475678b7aa5cc

    • C:\ProgramData\smes\kwsui.dll

      Filesize

      433KB

      MD5

      45199dab51eeece95728abfe25e18f35

      SHA1

      59ab0fe25aa2adc253adbecba6862e7432df1c39

      SHA256

      a22006861cac6a849346282e2f7729deeb8f68bf29f13c15ae33d20311f77391

      SHA512

      825c6ae1f88cec3d6c469e6a15cad0430845ecc8d436777092f4c5fe8ecd02abbfeb3e2a17b2f4896b9d6e4b2d229a8b83bfdda75a3e025fc32f86610c6eef12

    • C:\ProgramData\smes\smes.exe

      Filesize

      209KB

      MD5

      1fa47f5b173cee5ef9c3ee1bda0c321e

      SHA1

      60ee40236f960affb01d569a32e1b05888bb081a

      SHA256

      b21526716068d2a8550780038e2b5ddb843d77890a07ec82ed9ce9dd0be52c64

      SHA512

      01f39376269a75510347fcf66ff2585b25d5e6e10e26b7feefa3af66e712a5f50c62bff6d40abee733e1ce965d17a2e443664838268eb7c7a2e36fc1c024224d

    • C:\ProgramData\smes\u.bat

      Filesize

      44B

      MD5

      704efba1aee1454561da552dda430498

      SHA1

      d20fb96683f769eb9cef1b0a068bcba70aeab9c2

      SHA256

      80b08d35bd27636e0774ce35ab57306f76edc6a0f7058cb1f93733cdf88bf94c

      SHA512

      7e0c9ede686238703af4893af8842c05c48ab1681ae273b32d8085cf1a17aae946c0c823a0a418787522a551d684367259ff8203ebca6e4ec69b6ded95231bd0

    • C:\Users\Admin\AppData\Local\Temp\nsyDBF9.tmp\AccessControl.dll

      Filesize

      10KB

      MD5

      055f4f9260e07fc83f71877cbb7f4fad

      SHA1

      a245131af1a182de99bd74af9ff1fab17977a72f

      SHA256

      4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc

      SHA512

      a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26

    • C:\Users\Admin\AppData\Local\Temp\nsyDBF9.tmp\FindProcDLL.dll

      Filesize

      3KB

      MD5

      8614c450637267afacad1645e23ba24a

      SHA1

      e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

      SHA256

      0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

      SHA512

      af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    • C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat

      Filesize

      135B

      MD5

      cd94b0989238975ab163f88f02affb64

      SHA1

      9c1e0dbc9e685862c9db2464167a28cf5b873032

      SHA256

      dcce0107e9ee75eaaeba7563e498627b04fce05e9a9738eac57f4a24dadc25a3

      SHA512

      8c55bfdb4daf7f06d438a21a848a63044cc4fcba326824f591bd161f946afcc980d13adc3941c92fb5875b5ed7108cb1161eb93dcab30d298a755286cac37c05

    • memory/2152-5-0x0000000010000000-0x0000000010003000-memory.dmp

      Filesize

      12KB

    • memory/3828-49-0x00000000020D0000-0x0000000002141000-memory.dmp

      Filesize

      452KB