Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 11:10

General

  • Target

    675893111f243b965cbf829005f0612c_JaffaCakes118.exe

  • Size

    47KB

  • MD5

    675893111f243b965cbf829005f0612c

  • SHA1

    bb0f943d4373b30297f02ba3f6c4746faf25a731

  • SHA256

    5d36244f243c33c7f0700231d92558d7ea84975310fb34900b7265560ee99e99

  • SHA512

    60ee509f19d417209504936521f0494560d331b1f1c9499cb58fdaf6158786604d10135d1a7e97bcc93078aacf03a291fc3d58f982d3b8f60fec756e22393cf0

  • SSDEEP

    768:8PZ7qtPegxpQozpzpn7UM4epXNeyvrvlTaXRubLrlFLy/CoNh/BRijM1/f/nKXlB:DBtQOzJUMRNXvxTaXEpI/7hz/3n6B

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\675893111f243b965cbf829005f0612c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\675893111f243b965cbf829005f0612c_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4624
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c start iexplore -embedding
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:5084
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -embedding
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2480
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1360
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\gos951C.bat"
      2⤵
        PID:1508
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\675893111f243b965cbf829005f0612c_JaffaCakes118.bat"
        2⤵
          PID:4712

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verE24.tmp

        Filesize

        15KB

        MD5

        1a545d0052b581fbb2ab4c52133846bc

        SHA1

        62f3266a9b9925cd6d98658b92adec673cbe3dd3

        SHA256

        557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

        SHA512

        bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3WWFCFW4\suggestions[1].en-US

        Filesize

        17KB

        MD5

        5a34cb996293fde2cb7a4ac89587393a

        SHA1

        3c96c993500690d1a77873cd62bc639b3a10653f

        SHA256

        c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

        SHA512

        e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

      • C:\Users\Admin\AppData\Local\Temp\675893111f243b965cbf829005f0612c_JaffaCakes118.bat

        Filesize

        307B

        MD5

        6a1a7b971a636bc7c4ed9b4517f2bce8

        SHA1

        405d39446276c0c205992fe587ca98942af887bf

        SHA256

        4ab7b5220309fa971de52ca25dc8ec56aba54703ebc4b82cb4f2a35c34edfb0c

        SHA512

        504177882d594ed16277416ec7c392ade5a382e16e0dbbed735c17315d88ba3b8c10660bdcd099d9592d6eb71ae2854692696555fb124fae8ef6fe41c7de1358

      • C:\Users\Admin\AppData\Local\Temp\gos951C.bat

        Filesize

        190B

        MD5

        611126ad8d153a8933c2436b144e136a

        SHA1

        f740256eaab2c588089dc3d3cd59225ad15ec8fd

        SHA256

        d16a1d32535f150ac488d729e48ddcfc3a3a96d6a3f712a285bf53bd700ac3b1

        SHA512

        6c9bbc3ac0afece5a04b69471875c0d6cce47ad87f1ff8c7c0f67fc70bbc01cb46db690b08a0c239f26c39b345d3ad76001b4b41c4aeb6d5b9fd0a87c60bd646

      • C:\Users\Admin\AppData\Local\Temp\gos951C.tmp

        Filesize

        26KB

        MD5

        a5f25b49632f6e91e0a0e8fa0465473f

        SHA1

        94a246dea7f6eeadedeacc3df3f353ddea306389

        SHA256

        a000322d6d7ee57b072461f651ecc6feecd5f3441d5353931ab7ab660cfaf913

        SHA512

        85765a3cd9b4c9b1031e0c2d3107ab74da0eef82f7712527e87e85164e718c5cc2e00080326b2fe99764602984d3817e96cda127c1d02cf8ddbc4b99f7141088

      • memory/4624-0-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/4624-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

        Filesize

        24KB

      • memory/4624-4-0x0000000010000000-0x0000000010012000-memory.dmp

        Filesize

        72KB

      • memory/4624-7-0x0000000000690000-0x0000000000695000-memory.dmp

        Filesize

        20KB

      • memory/4624-16-0x0000000010000000-0x0000000010012000-memory.dmp

        Filesize

        72KB

      • memory/4624-15-0x00000000001C0000-0x00000000001C6000-memory.dmp

        Filesize

        24KB

      • memory/4624-14-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB