Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 17:27

General

  • Target

    641a918d87d25c9a4cd3c49ea7d42b3a_JaffaCakes118.dll

  • Size

    15KB

  • MD5

    641a918d87d25c9a4cd3c49ea7d42b3a

  • SHA1

    39b6976e6897fbd0e9449073d3fc6a78e5105c03

  • SHA256

    a488f4ba2d9c7ac99c59dd503d4e53f6b50e78ef11aebad71d62e0d5821e6bb4

  • SHA512

    3b46e6995056ae03a5a136ef406fc9570567d793bc57e9806e0ce24f3377a3f203f30c4f6cfa8ae64a8a20df7dc80963f5e344b23b16a7019dd7ea7b38caa81a

  • SSDEEP

    192:R+jOaONXcf9XwYneW04i1wnrGgHFSCFhqojUyPWwTvHqzfk5/RINNqyKzbB063cV:QeAzeWQuXFSCS3y/jKgKNdCbBo

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 59 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SetWindowsHookEx 40 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\641a918d87d25c9a4cd3c49ea7d42b3a_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\641a918d87d25c9a4cd3c49ea7d42b3a_JaffaCakes118.dll,#1
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Modifies registry class
      PID:4908
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:4944
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3144
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:82948 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4976
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:82952 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2756
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:82956 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4404
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:82962 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2036
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:82968 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4448
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:82974 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3420

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      471B

      MD5

      5fe1d5be97aa5a4b444680410010b626

      SHA1

      0b747d5b13d5745fcc81a5819b2db8e11543ab42

      SHA256

      018bb27ecbb368115c6dc85539b5d24b0f7d548a3cc81ace6f7fbdc2a5aa55d4

      SHA512

      b3baa42206a9866e37dbe747a04d82d49e51e8219a8ac51170498cbdb98430a6b3f591151d3dfb133b1734f6fefc62b90efbbb907c800f45e93eae998c009fbe

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      404B

      MD5

      f11eaecbdd5ed71d427edf3696a5eda3

      SHA1

      f85761ec1d8810c2a5e7fc760568915ba3416ff0

      SHA256

      c9422091713e3df3a6e1d6e87b5b0d94428e74fbb7f963970bbf27ab7c09dde4

      SHA512

      7562b006e61025fafd0c51982fdc32caa37e64c01dfd4764a5628f7df5f2ae6971c31234cb433c22ed7ba75f6b1d1d1937c9f9a97e215aced383e041adec2584

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver599.tmp

      Filesize

      15KB

      MD5

      1a545d0052b581fbb2ab4c52133846bc

      SHA1

      62f3266a9b9925cd6d98658b92adec673cbe3dd3

      SHA256

      557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

      SHA512

      bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5G8JI3LV\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    • C:\Users\Admin\AppData\Local\Temp\~DF47A5FAD4A67FCEF7.TMP

      Filesize

      16KB

      MD5

      1d896b404473d591dd3368c258459787

      SHA1

      1cdf8c6d7967dd99fa6d7775579ea31f0e372ade

      SHA256

      ba861cb728588bf6246fe67b127bb879d3a0505806f2a25ad2aaca5cd6810cd7

      SHA512

      0ee980ecfaf150f402e94620cb521024411dd43fa88418be1c0c0bb44a13b6daa9007ba8b88772368e44290de2340929f555d51df74c8f8c1470f3410b765c74

    • memory/4908-0-0x0000000010000000-0x000000001000B000-memory.dmp

      Filesize

      44KB

    • memory/4908-1-0x0000000002D20000-0x0000000002D21000-memory.dmp

      Filesize

      4KB

    • memory/4908-2-0x0000000010000000-0x000000001000B000-memory.dmp

      Filesize

      44KB

    • memory/4908-4-0x0000000002D20000-0x0000000002D21000-memory.dmp

      Filesize

      4KB