Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2024, 13:38

General

  • Target

    6fcdccdb6165e840f34cb0147f0e9535_JaffaCakes118.exe

  • Size

    353KB

  • MD5

    6fcdccdb6165e840f34cb0147f0e9535

  • SHA1

    ac3901d5e79c55605a67754f0662a591285a6e70

  • SHA256

    76cc280d217092eb8bdae8504f14d6e9fcd5fef56887c762b45d03bac8183650

  • SHA512

    0090e279af2c0ce4123a88710efdd42aa6b8d4f8de2531bebecd6c64bf0bed74051f3c0295b9db03393e379fc6b27b5063593c2348625768e2da8d1d47f699b1

  • SSDEEP

    6144:zDe7lKbsPlMg/yO9TC7d/SoLFjjbVrBZ8yBH:uZPlMtd/SoRjbVrBZ8E

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fcdccdb6165e840f34cb0147f0e9535_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6fcdccdb6165e840f34cb0147f0e9535_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:1156
  • C:\Windows\servicing\TrustedInstaller.exe
    C:\Windows\servicing\TrustedInstaller.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

    Filesize

    567KB

    MD5

    27d54a9bd38ffb85c78640a37642d071

    SHA1

    8337e3ac68aac924609839ee7ea882d80ee86b05

    SHA256

    fd90c16d02b5036dfadc6e7ebae1b2ab550dbbce15b1906c15f5cda7f1f21bbe

    SHA512

    5e68e59e7d25d0276efe09bd3bd828e9dc702e5acfd5e4d4f06deee4cbd6494322de2bc2e8141033c691f92fcd93f5886a9b07df002151b799822bbed22376ff

  • C:\Windows\SysWOW64\msiexec.vir

    Filesize

    202KB

    MD5

    910dcd432691242047ffb398e7d05cea

    SHA1

    59da0e773a594fb59654862950e09f47d0c3f52b

    SHA256

    d1ae0513647b1cc0ba9ad4967a5d12bc371fb2d9dd04e9086030e8eadb169618

    SHA512

    a2702afd94a0956f7b94a0f33cc4718ea19bc876578e74edc1d3cadb61adf49daf7e89cc4dbe41d529d87edf58ee0cb87f34c7430244e2969644902fe650175b

  • C:\Windows\servicing\TrustedInstaller.exe

    Filesize

    193KB

    MD5

    805418acd5280e97074bdadca4d95195

    SHA1

    a69e4f03d775a7a0cc5ed2d5569cbfbb4d31d2d6

    SHA256

    73684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01

    SHA512

    630a255950c0ae0983ae907d20326adea36ce262c7784428a0811b04726849c929bc9cea338a89e77447a6cec30b0889694158327c002566d3cf5be2bb88e4de

  • memory/1156-0-0x0000000001000000-0x0000000001097000-memory.dmp

    Filesize

    604KB

  • memory/1156-1-0x0000000001006000-0x0000000001008000-memory.dmp

    Filesize

    8KB

  • memory/1156-33-0x0000000001000000-0x0000000001097000-memory.dmp

    Filesize

    604KB

  • memory/1156-34-0x0000000001000000-0x0000000001097000-memory.dmp

    Filesize

    604KB