Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 12:33

General

  • Target

    7411d61e4a87fa69c22e010fa3b4cc70_JaffaCakes118.dll

  • Size

    649KB

  • MD5

    7411d61e4a87fa69c22e010fa3b4cc70

  • SHA1

    60f03149a300810d6e00f36aa223c23505aa2cd1

  • SHA256

    e270ca84eff5f2885d76bba6fdfc79e22c7cab5b4d7b0707422e1a0416276cbc

  • SHA512

    1ebe77a8c42219a3ba18ecae8a69084737cd2c6d78205db70184cc6174e71f59b1f080c25a04781db98d7d47e4cea65983e0f29718f042c29e73cf665e01216e

  • SSDEEP

    12288:X2KXu1WZZ/5y3In6RNIXR7QuRq4eLh0Hou+WXhqE9pZoc8rZl5SwFeb8:X2xAZZxpAY7cJLKIdE9pd8rZQb

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7411d61e4a87fa69c22e010fa3b4cc70_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\7411d61e4a87fa69c22e010fa3b4cc70_JaffaCakes118.dll
      2⤵
      • Adds Run key to start application
      • Installs/modifies Browser Helper Object
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:4652
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2136
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2280

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    3657335e6a16bf2e31605028126baadb

    SHA1

    e5d5a1fb18511ebcb49494570a94b92527540114

    SHA256

    433b51bbdd8a72ef859d9e4bc11030dd61b20e78db25fda3780d5ae8fe706548

    SHA512

    29b6d77cb3850711312b6578dc8f647018c1e7ea7ff1a375f55563dd69395d03a960d11e6a83d77c0a93695440fb1c3522cfbd4c957e6e06c82c9e8650785848

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    e7be79a4b3ef30c9a83c2fddfc3b32d5

    SHA1

    627c84bf275cb0870a6b50dbdd7f2aec18565626

    SHA256

    5b88c2519364f260aa35f368dd6568d7258065b929516365a9d527bf362afb1b

    SHA512

    55cb9f7941d8f4e2873afb37d922d646fae563a8f2e3248dfcbb62d8b3d28c46f604c784cb178b7e2cf59263511c1c250fc10f249aa3a491223de67839c245d8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QOWVUGSW\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • memory/4652-0-0x0000000002500000-0x0000000002B08000-memory.dmp

    Filesize

    6.0MB

  • memory/4652-12-0x0000000002500000-0x0000000002B08000-memory.dmp

    Filesize

    6.0MB