Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2024, 14:09

General

  • Target

    6fe6d4049a882039e87afe89773e8a8b_JaffaCakes118.exe

  • Size

    601KB

  • MD5

    6fe6d4049a882039e87afe89773e8a8b

  • SHA1

    c6193076a56f88a12f4fa5c9dd4027bd6d28e6ef

  • SHA256

    55f6eec5aa87955b8cbd85a4aa0a0827f8c2f6517687842b6c2a293395cb1f8e

  • SHA512

    c4e7b30e09d23749b14efcdde39b28109dc33f5682f287b19b778a228496407e990465895e55a209b08404b8298fd3389d75c3e1cc4742d1121a3e216fb3632c

  • SSDEEP

    12288:oGok/MGnfel9KYs5u7INZEg0mG9TvJTs9lIjSCCRp05Uf/4zlRkhQEqnP:DLnfel9qpZ9GRvmlIsTP/MxvnP

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fe6d4049a882039e87afe89773e8a8b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6fe6d4049a882039e87afe89773e8a8b_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Windows\SysWOW64\boor.exe
      C:\Windows\system32\boor.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1140
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3652
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3652 CREDAT:17410 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1548
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\del_file_1.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    021bab2a16417342ed4183f51717f05b

    SHA1

    8f443ca424429a32784da4dd7db4417b55288b48

    SHA256

    f6a679f6b4dbee865d3441be7295caf63fd601a48c02ab1405fab4a9339c0a6e

    SHA512

    73ba5f70344bb2d9b50195eeb9f6ad9463d8827f9d48a0026323fb810421f2e5a6d1c9f626b0f5e8dd2c0e9783bf5f561b821e73b0f5f31f99423ee1b46543b4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    3d3d7092bd672c06ce1de6ab93c000c0

    SHA1

    6c6d8b837d381d90c3fb3bbc2bffb92024939c1d

    SHA256

    3353cf473c2b0b6a584010d65d2eab781ad54792bd485cc3eb12a0d69d49f619

    SHA512

    15d44f0edc0dd198622e6d1035733e9e1ccd443453cb9923cdb088155bceca70b68312d7d57a3743de7359122c427f9edadc2ea446d97e5180726c585cd5f942

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verF145.tmp

    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\A4F1OTIC\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\E_4\Exmlrpc.fne

    Filesize

    72KB

    MD5

    4b93667fd1049edc44df7888773e24d6

    SHA1

    45a73a3b4c3e43118c6b264a5dd7d30b6cca4e4f

    SHA256

    f650908d54de80e4cf3a7859efe11812e41e3e4515050434cff904e6a150453a

    SHA512

    7bffbc049906b990c12820afe004b67b32c83a71c6bd36f6222ff062e9bced38a03f6d80e2dd7b269845ddd986b1517b5e136f5c772d7c6c93f7dc4d12bda0b6

  • C:\Users\Admin\AppData\Local\Temp\E_4\dp1.fne

    Filesize

    124KB

    MD5

    a062fbf36321864ac8e7e2e408ff0d90

    SHA1

    8cc46a09096eb373e5e01d7547f108eb09bbac9d

    SHA256

    249a27ede8d0fbd3e5dd89b9150d1215c7ae1dc2f137db5a67cee44e6b5c0431

    SHA512

    2ddb24f7f9a6f6b17b4ac3a5e0b4cfe9424a710ef34c7918754bcd4acff8ff41e043c2e8ab829da42d2e4a80cc45b59f309253833ba3d7329ba79d7fc7128819

  • C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

    Filesize

    406KB

    MD5

    6aea0226a87d8d144963ab68b02009ac

    SHA1

    6dcc3d247ac8e872c8cfb7db73e1de1032fc6b11

    SHA256

    ad7a6428108f2d01f2e1b747fc5f225fe7e32da7219c7df017a566566954b173

    SHA512

    d171cb12715b1952d4f214780472668d57604e1f4efba798f1a84dab633ab39a95830ec80dee4a7abfa5969ea4d472f21f54d99ff480d02660c41e3f9489af4a

  • C:\Windows\SysWOW64\boor.exe

    Filesize

    601KB

    MD5

    6fe6d4049a882039e87afe89773e8a8b

    SHA1

    c6193076a56f88a12f4fa5c9dd4027bd6d28e6ef

    SHA256

    55f6eec5aa87955b8cbd85a4aa0a0827f8c2f6517687842b6c2a293395cb1f8e

    SHA512

    c4e7b30e09d23749b14efcdde39b28109dc33f5682f287b19b778a228496407e990465895e55a209b08404b8298fd3389d75c3e1cc4742d1121a3e216fb3632c

  • \??\c:\del_file_1.bat

    Filesize

    235B

    MD5

    9b80e9bb09ea68ff30425d3ba37524f6

    SHA1

    d8e5ad40e1cf891eadc540cc306af4c41ff98198

    SHA256

    49f50f5724625a5948ef287517e8629cfd3b5a87f4ab8440be463b7f68e40b9e

    SHA512

    4bf3b8a991d4a1ac5093643f87db88d17c350e0beddcb43ed6d6783d8257b0a042fcbccad5fc247229b17970becbc997a8285c9dcc31517fa9b902d1d8686b34

  • memory/1140-43-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

  • memory/1140-44-0x0000000010000000-0x000000001012A000-memory.dmp

    Filesize

    1.2MB

  • memory/1140-31-0x0000000002590000-0x00000000025B1000-memory.dmp

    Filesize

    132KB

  • memory/1140-21-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

  • memory/1644-38-0x0000000010000000-0x000000001012A000-memory.dmp

    Filesize

    1.2MB

  • memory/1644-37-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

  • memory/1644-0-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

  • memory/1644-11-0x0000000002310000-0x0000000002331000-memory.dmp

    Filesize

    132KB

  • memory/1644-5-0x0000000010000000-0x000000001012A000-memory.dmp

    Filesize

    1.2MB