Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

642828913b...18.exe

windows7-x64

7

642828913b...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2024, 17:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    642828913b14f027828764150ea5d18f_JaffaCakes118.exe

  • Size

    238KB

  • MD5

    642828913b14f027828764150ea5d18f

  • SHA1

    656ec6e56db3bd0176d46b44af23b20ab616eee4

  • SHA256

    1d14c73c9b45a28d1d259b1b05dace849e2f79b0a73aa3015697159259a12721

  • SHA512

    c763047021f5acf9e25d70c506483b186e4d5a5f47178a2f9a985e9a4d0551977d03b3888e2fe756204c2b5441bc1f0890d74c4532e7a1cee009192e597bd59c

  • SSDEEP

    6144:mgP/Cp0w0NQmvG3W9D8fDAIWXkUIh6g+j:Kpwemv0W9DaW0Ue6x

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 29 IoCs
  • UPX packed file 37 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\642828913b14f027828764150ea5d18f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\642828913b14f027828764150ea5d18f_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "C:\Users\Public\Desktop\上网主页.lnk" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2656
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "C:\Users\Admin\Desktop\Internet Explorer.lnk" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3024
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "C:\Users\Public\Desktop\Internet Explorer.lnk" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2132
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "C:\Users\Public\Desktop\淘宝购物.lnk" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:348
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "C:\Users\Public\Desktop\在线小游戏.lnk" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:588
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "C:\Users\Admin\AppData\Local\Temp\tb.ico" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex"
      2⤵
      • Executes dropped EXE
      PID:1508
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "C:\Users\Admin\AppData\Local\Temp\642828913b14f027828764150ea5d18f_JaffaCakes118.exe" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2144
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "C:\Program Files\Realtek\ations.sot" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1264
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "C:\Program Files\Realtek\youwo.sot" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1380
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "C:\Program Files\Realtek\duoyu.oed" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex"
      2⤵
      • Executes dropped EXE
      PID:3036
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{031E4825-7B94-4dc3-B131-E946B44C8DD5}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2124
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1260
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{138508bc-1e03-49ea-9c8f-ea9e1d05d65d}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:324
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{4336a54d-038b-4685-ab02-99bb52d3fb8b}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2892
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2888
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{89D83576-6BD1-4c86-9454-BEB04E94C819}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2904
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{B0FBD52D-C4A7-4a19-985D-11309D1AC8AE}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3064
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{BD7A2E7B-21CB-41b2-A086-B309680C6B7E}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2424
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e345f35f-9397-435c-8f95-4e922c26259e}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1316
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1740
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{04731B67-D933-450a-90E6-4ACD2E9408FE}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3012
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{26EE0668-A00A-44D7-9371-BEB064C98683}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1440
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{59031a47-3f72-44a7-89c5-5595fe6b30ee}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2220
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{9343812e-1c37-4a49-a12e-4b2d810d956b}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1332
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{daf95313-e44d-46af-be1b-cbacea2c3065}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:316
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{11016101-E366-4D22-BC06-4ADA335C892B}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2516
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1132
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1112
    • C:\Users\Admin\AppData\Local\Temp\Netcro.bat
      Netcro.bat -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}" -ot reg -actn ace -ace "n:everyone;p:full"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Desktop\Internet Explorer.lnk
    Filesize

    1KB

    MD5

    969d294f013edda2002e9a98b6db4c33

    SHA1

    1f897c30b1e521f93423db8b9c35fb6c1d1e6246

    SHA256

    3b1c764951a112ef65eb3fac04d4e7d0eadfed1e3742d948c7814dbbb3092050

    SHA512

    89bf460b146ac8a6c1e1a4cf682a502b3da01633a29e8253f02cc02182c16670b8a5ac1c99335e405086c2cbd8fbe09c48f40fc0d56b721c3a71aea795e921ec

    Download Submit

  • C:\Users\Public\Desktop\Internet Explorer.lnk
    Filesize

    1KB

    MD5

    033fda28f96c5f739b513d559fbe11a2

    SHA1

    f3a50dcf3c00f6b603e83e744443b80014280571

    SHA256

    505b112065fb1332348ac3c6f7221c5cf3e616a7d4d7e218fc27e6bba6a4b0a0

    SHA512

    08ee5e41d1baee079780e6afaa25ff7cf8ce3d659cdf4cc14ee4b8deccc4aeab09f03f4e60d8d1551d411c1e88fc257c838d10f019695179ff908fd89bc3be05

    Download Submit

  • \Users\Admin\AppData\Local\Temp\Netcro.bat
    Filesize

    136KB

    MD5

    627985c64dd0a467645025c2f5b34be2

    SHA1

    e577e48ddddcf86f2bc0920af3d080139c34ee0e

    SHA256

    7bac250643d481ea8f492efc3a9e226e6f8b04bfa474d37321a16c215066791b

    SHA512

    6556c0ec4aaf17be4aa6459667358e936f40bd5ccae49658c80e164df8f4a9d449bbb744fd63811d2d4de9f4da6b0a0c241317110e10bd7afef8c97871da60b1

    Download Submit

  • memory/316-145-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/324-126-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/348-119-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/588-118-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/588-103-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/1112-140-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/1132-155-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/1260-153-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/1264-161-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/1316-130-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/1332-128-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/1380-159-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/1440-147-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/1508-165-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/1732-151-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/1740-141-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2124-124-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2132-120-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2132-102-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2144-157-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2220-138-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2424-149-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2516-136-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2656-95-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2656-113-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2764-71-0x0000000003730000-0x0000000003787000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2764-108-0x0000000003730000-0x0000000003787000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2764-107-0x0000000003730000-0x0000000003787000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2764-64-0x0000000003730000-0x0000000003787000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2764-36-0x0000000003730000-0x0000000003787000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2764-62-0x0000000003730000-0x0000000003787000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2888-134-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2892-122-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/2904-143-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/3012-163-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/3024-94-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/3024-110-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/3036-167-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download

  • memory/3064-132-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

    Download