Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 09:05
Behavioral task
behavioral1
Sample
7368608a333ad3f51c7521310b62cfab_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
7368608a333ad3f51c7521310b62cfab_JaffaCakes118.exe
-
Size
123KB
-
MD5
7368608a333ad3f51c7521310b62cfab
-
SHA1
11bb7e2126928c79c82107810b60e0e0ba6f61c5
-
SHA256
a67e2dd170fbc8e797bf713d31bf9739f190bde40eff64114445c404f0b104c8
-
SHA512
e56d92f72b2e4df938dd93b2dc94947915513a7b4c063a19d0a2ad2fd19fd8a83c5b9803e17e1c987a0f4215ab01aed5d97037daf9773e4a2b507316a71ee0bd
-
SSDEEP
3072:ueSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLL2Rfd3:uVYrJrOSsRwcpY
Malware Config
Signatures
-
Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\62119EF862C6B3A0D853419B87EB3E2F6C78640A\Blob = 03000000010000001400000062119ef862c6b3a0d853419b87eb3e2f6c78640a2000000001000000df030000308203db30820344a00302010202033fc398300d06092a864886f70d01010405003055310b3009060355040613025a4131253023060355040a131c54686177746520436f6e73756c74696e67202850747929204c74642e311f301d0603550403131654686177746520436f6465205369676e696e67204341301e170d3035303831353031353134345a170d3037303931363133323531325a30818b310b3009060355040613024652310e300c0603550408130552686f6e65310d300b060355040713044c796f6e31193017060355040a1310656c656374726f6e69632d67726f757031273025060355040b131e536563757265204170706c69636174696f6e20446576656c6f706d656e743119301706035504031310656c656374726f6e69632d67726f757030820122300d06092a864886f70d01010105000382010f003082010a0282010100e2754d8a4e6d4db6e025b0073520ddd7eeec116a813940fda2c4c66f7a354adb3036188d4078f8891b3fe15d467dfba5e17984cac2b246c27c052e63956dfe817eb423b9615bddfddaadac5e2ac0f41f583edd24d7830f5875df2937a9152b741eef3950e5116e76d2e7e3ffdf6fcb5858af26f5e2effd019a1f82b98d7f21ed089d5bb8553cd89c823becaeb62ea1cc4b455cb4e93e8ac715320f31dc3fbc2d0be0d65c608c58c19ff06da7bc1ec48a45ef0219eef40294504e2663b1c9dad6a2241df996c59cf110b706285fbaeae0c55d776573536218c3c7ae248b82cae01513cd8b2828a94f4a70ba6e199919a0f5eae20643feaabebe2ba3b2819e92790203010001a381fd3081fa301f0603551d250418301606082b06010505070303060a2b060104018237020116301106096086480186f8420101040403020410301d0603551d0404163014300e300c060a2b0601040182370201160302078030230603551d11041c301a82187777772e656c656374726f6e69632d67726f75702e636f6d303e0603551d1f043730353033a031a02f862d687474703a2f2f63726c2e7468617774652e636f6d2f546861777465436f64655369676e696e6743412e63726c303206082b0601050507010104263024302206082b060105050730018616687474703a2f2f6f6373702e7468617774652e636f6d300c0603551d130101ff04023000300d06092a864886f70d01010405000381810075160a692f4bc2096bce67c58b0d88320552104e4d35f5018bc2ab1be03ecae3c0abe7db45629b1b3c1812039145c15d6f2774c211a2c86f93a819573d58a3c0e66d1e19e84638800e3372880b4e9cdcf70cc769bdeff236ed3ac6f20e370122fa791e71b0ea8be78077ffc288c382b201d78ea8bbf9e9457fad4ee80273279c regedit.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0007000000023471-27.dat acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation iaccess32.exe -
Executes dropped EXE 1 IoCs
pid Process 2856 iaccess32.exe -
Loads dropped DLL 1 IoCs
pid Process 2592 regsvr32.exe -
resource yara_rule behavioral2/memory/3944-0-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/files/0x0009000000023401-3.dat upx behavioral2/memory/3944-6-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2856-7-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/files/0x0007000000023471-27.dat upx behavioral2/memory/2592-29-0x0000000010000000-0x0000000010047000-memory.dmp upx behavioral2/memory/2856-59-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\egaccess4_1071.dll iaccess32.exe -
Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files (x86)\Instant Access\Multi\20110121080122\dialerexe.ini iaccess32.exe File created C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110121080122\medias\p2e_1_3.gif iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110121080122\medias\p2e.ico iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110121080122\medias\p2e_logo_2.gif iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110121080122\medias\p2e_2_3.gif iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110121080122\medias\p2e_go_3.gif iaccess32.exe File opened for modification C:\Program Files (x86)\Instant Access\Multi\20110121080122\dialerexe.ini iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110121080122\Common\module.php iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110121080122\medias\p2e_3_3.gif iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110121080122\instant access.exe iaccess32.exe File created C:\Program Files (x86)\Instant Access\DesktopIcons\NOCREDITCARD.lnk iaccess32.exe File opened for modification C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk iaccess32.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\dialexe.zl iaccess32.exe File created C:\Windows\dialexe.epk iaccess32.exe File created C:\Windows\dialerexe.ini iaccess32.exe File created C:\Windows\egdhtm_pack.epk iaccess32.exe File created C:\Windows\iaccess32.exe 7368608a333ad3f51c7521310b62cfab_JaffaCakes118.exe File created C:\Windows\tmlpcert2007 iaccess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7368608a333ad3f51c7521310b62cfab_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iaccess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iaccess32.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\IESettingSync iaccess32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" iaccess32.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iaccess32.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\À iaccess32.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ = "C:\\Windows\\SysWow64\\egaccess4_1071.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83} regsvr32.exe -
Runs regedit.exe 1 IoCs
pid Process 3336 regedit.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3944 7368608a333ad3f51c7521310b62cfab_JaffaCakes118.exe 2856 iaccess32.exe 2856 iaccess32.exe 2856 iaccess32.exe 2856 iaccess32.exe 2856 iaccess32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3944 wrote to memory of 2856 3944 7368608a333ad3f51c7521310b62cfab_JaffaCakes118.exe 84 PID 3944 wrote to memory of 2856 3944 7368608a333ad3f51c7521310b62cfab_JaffaCakes118.exe 84 PID 3944 wrote to memory of 2856 3944 7368608a333ad3f51c7521310b62cfab_JaffaCakes118.exe 84 PID 2856 wrote to memory of 3336 2856 iaccess32.exe 85 PID 2856 wrote to memory of 3336 2856 iaccess32.exe 85 PID 2856 wrote to memory of 3336 2856 iaccess32.exe 85 PID 2856 wrote to memory of 2592 2856 iaccess32.exe 86 PID 2856 wrote to memory of 2592 2856 iaccess32.exe 86 PID 2856 wrote to memory of 2592 2856 iaccess32.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\7368608a333ad3f51c7521310b62cfab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7368608a333ad3f51c7521310b62cfab_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\iaccess32.exeC:\Windows\iaccess32.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s C:\Windows\tmlpcert20073⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Runs regedit.exe
PID:3336
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Windows\system32\egaccess4_1071.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2592
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
668B
MD51247b4a0c3a3b4f9a8e86edc8974e109
SHA13cc7b136ec05bef775839ef059ec94f4ec3edf61
SHA25603c554f0f50540e40969589f68b997f7e6e0e76fec4f60fb6b304d55cef78115
SHA51245ca9c4dcccfbb204a4e0cd04253307e34827d7331f9744ec70df300177aff8aa30aea0b1673aa9e7af66b5785c1f8f6ce939db6c3b5d7b6db89dbc9c7a4059d
-
Filesize
2KB
MD541558db5ba5417f44ddf53f567b51a91
SHA19bbe1f02910416803780acfc984fc410c9d41d85
SHA256822171a3565aa30c3ec7689252e81bc5d7bc4411ce6c1ca5eb08141b298273cb
SHA5127784b0941ade63cbb287e410a3f737e6f6b3836716fb03401b684b557d4d261b7da6662af91e964887d0142621b2e103f00a0f57270b100180196283331023ba
-
Filesize
2KB
MD53f8c7782b2a2d1beb5a38ab63cd07fb9
SHA1ad92a51f792cb72b3d043d35420f82cf6ae334e9
SHA256f7a636b63ebe46a81bad863e0b593d04b7ab263f3377eeb682d4c0d240b0583e
SHA512370819601afbc1ecc86ecbce06a7febebfda56954765f68281837f081a7d8c964373dfb0d3dfd62aa083814755a535d0d93cc15f5beaae0bec241d0b13acc1dc
-
Filesize
76KB
MD5b83f652ffa76451ae438954f89c02f62
SHA1b3ba0014dd16cee5f6d4cfe7e28b2d5de79dc6dd
SHA256f601991aa00cbe7001197affc0e3854ab76c51c05b9a6ca3e3f708fed876c32f
SHA512965172a5ecd070ea6707ec9985ee3c135c06534561b90ae233e8049b247d87d529b8280f0faf2b0ed933f59c68844414726fa80c4d3119cffa4fdd1cb60eab83
-
Filesize
123KB
MD5b1ccb4c677b85de8094d663951bbdc34
SHA1fbf59b61fb61fbbe927f5b5fc202373ac29cc6ab
SHA256896eb406b34b1102218fc526619fbf975965b5c9692acab2ae745c233cdd9c21
SHA51223d7345a988e8a4e56bbd342a0f8adc8027754218001809f4311c77fc346be40cec033ddee080a889b4bcbba5121930e4374353e3c6a2c9bacb3897fdff86bf3
-
Filesize
6KB
MD5b103757bc3c714123b5efa26ff96a915
SHA1991d6694c71736b59b9486339be44ae5e2b66fef
SHA256eef8937445f24c2bcbe101419be42694e0e38628653a755ab29ecba357d81d48
SHA512d04f2ab14ad4d3e06ea357b4c810515d73b32f2650533a5895ebf5d14b4b697752f25c0c371372e00faab661c0b051c33b8c25bf1226f30be5d6b8727dea81e1