Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 01:56

General

  • Target

    72286a2f8319db8606fb34892e88750a_JaffaCakes118.exe

  • Size

    141KB

  • MD5

    72286a2f8319db8606fb34892e88750a

  • SHA1

    feb65e6daf7a5386c059ba171a32c39d109375f8

  • SHA256

    d9522844d78148890f42f4b6747fea772dfd2af8c22118e082880866f37feebb

  • SHA512

    b5a2673d8bbb59661d29a3228492eb8f865ed0a97eb91dfd0e82700095312ae3a7b434af7c0a771fbb34ef75cb37ed13bb2be8b97294c535f0a48bf8d52d10ee

  • SSDEEP

    3072:Y8MT8d+KIcHzuj0kAuQT0c1vj6dJRUJChjmDhCPWu7B1C0LcV0kSX:YN8dJIf7OV7JChjmDQgVT

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72286a2f8319db8606fb34892e88750a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\72286a2f8319db8606fb34892e88750a_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Users\Admin\AppData\Local\Temp\72286a2f8319db8606fb34892e88750a_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\72286a2f8319db8606fb34892e88750a_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Recycle.Bin\Recycle.Bin.exe
        "C:\Recycle.Bin\Recycle.Bin.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2252
        • C:\Recycle.Bin\Recycle.Bin.exe
          "C:\Recycle.Bin\Recycle.Bin.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5036
          • C:\Users\Admin\AppData\Local\Temp\Hpe7BA8.exe
            "C:\Users\Admin\AppData\Local\Temp\Hpe7BA8.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer Phishing Filter
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Recycle.Bin\Recycle.Bin.exe

    Filesize

    141KB

    MD5

    72286a2f8319db8606fb34892e88750a

    SHA1

    feb65e6daf7a5386c059ba171a32c39d109375f8

    SHA256

    d9522844d78148890f42f4b6747fea772dfd2af8c22118e082880866f37feebb

    SHA512

    b5a2673d8bbb59661d29a3228492eb8f865ed0a97eb91dfd0e82700095312ae3a7b434af7c0a771fbb34ef75cb37ed13bb2be8b97294c535f0a48bf8d52d10ee

  • C:\Recycle.Bin\config.bin

    Filesize

    5KB

    MD5

    66c58bd5b39a6581f4fb593f9164db51

    SHA1

    0a28091e3bffa65fa507158e611bb8a7abc7e207

    SHA256

    3b9d78109a59e5b1544bca9fefc85d1f47260d5037e0ca4927ebcbf7279b3391

    SHA512

    2d5370dfa6e8f607c0e8c1b8c5d33357831fd044da6760410b5088a650f995299062c4ad3ecdeaa4ea97548afcad3100d87d020b097ceaca5d8ca64b68f95ee5

  • C:\Users\Admin\AppData\Local\Temp\Hpe7BA8.exe

    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • memory/2252-37-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2252-25-0x0000000074E70000-0x0000000074FCD000-memory.dmp

    Filesize

    1.4MB

  • memory/2252-24-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2496-92-0x0000000077222000-0x0000000077224000-memory.dmp

    Filesize

    8KB

  • memory/2496-11-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2496-15-0x0000000000650000-0x0000000000651000-memory.dmp

    Filesize

    4KB

  • memory/2496-16-0x0000000000650000-0x0000000000651000-memory.dmp

    Filesize

    4KB

  • memory/2496-8-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2496-20-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2496-9-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2496-5-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2496-93-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/2496-94-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/2496-90-0x00000000007A0000-0x00000000007A1000-memory.dmp

    Filesize

    4KB

  • memory/2496-89-0x00000000007A0000-0x00000000007A1000-memory.dmp

    Filesize

    4KB

  • memory/2496-12-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2496-7-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2496-14-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/3848-53-0x0000000000460000-0x00000000004AD000-memory.dmp

    Filesize

    308KB

  • memory/3848-73-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-54-0x0000000000460000-0x00000000004AD000-memory.dmp

    Filesize

    308KB

  • memory/3848-61-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-64-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-63-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-62-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-58-0x0000000000460000-0x00000000004AD000-memory.dmp

    Filesize

    308KB

  • memory/3848-57-0x0000000000450000-0x0000000000456000-memory.dmp

    Filesize

    24KB

  • memory/3848-56-0x0000000001000000-0x0000000001004000-memory.dmp

    Filesize

    16KB

  • memory/3848-55-0x0000000001001000-0x0000000001002000-memory.dmp

    Filesize

    4KB

  • memory/3848-72-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-51-0x0000000000460000-0x00000000004AD000-memory.dmp

    Filesize

    308KB

  • memory/3848-50-0x0000000000460000-0x00000000004AD000-memory.dmp

    Filesize

    308KB

  • memory/3848-49-0x0000000000460000-0x00000000004AD000-memory.dmp

    Filesize

    308KB

  • memory/3848-67-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-70-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-82-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-87-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-88-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-85-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-84-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-83-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-81-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-80-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-79-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-78-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-77-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-76-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-75-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-74-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-43-0x0000000000460000-0x00000000004AD000-memory.dmp

    Filesize

    308KB

  • memory/3848-71-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-69-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-68-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/3848-66-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4256-13-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/4256-1-0x0000000074E70000-0x0000000074FCD000-memory.dmp

    Filesize

    1.4MB

  • memory/4256-2-0x00000000005C0000-0x00000000005C3000-memory.dmp

    Filesize

    12KB

  • memory/4256-0-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/5036-41-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/5036-35-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/5036-34-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB