Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
28/07/2024, 21:13
Static task
static1
Behavioral task
behavioral1
Sample
243979694b054a96137dac617876bcdb_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
243979694b054a96137dac617876bcdb_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
243979694b054a96137dac617876bcdb_JaffaCakes118.exe
-
Size
510KB
-
MD5
243979694b054a96137dac617876bcdb
-
SHA1
f9c429224a786fb11bb4e12a50823a1e7f035745
-
SHA256
3566accfc4308a1d6b1a76c175664f4cbd7e0e542f323a252faf325b77bc8edf
-
SHA512
29e03b97294dd4e30c68851c732a097b2cde0c1098aad5760a8ad2c80fabd6151feead15c2f48a12a3eee3266861a814bd3837af7e39144d7e376aa7ffdb3921
-
SSDEEP
12288:458WhWmNEYOyFeMG9b/KxiCWom2pBm5ic6g6MmMrcIdsGC9:45dxNDE9bKxzWo0cWC9
Malware Config
Extracted
formbook
4.1
dmn
makemecookies.com
highlandseniorcare.com
artnowmedia.com
realmusicschool.com
daporn.pro
xn--meditaoevida-7bb9c.com
uniqueskinproducts.com
xmoncatto.com
shaloutuan.com
mixednotshaken.com
pulseslondonuk.com
bestkeptsecretportland.com
xpj888n.com
natureswayentertainment.net
alkhemilia.com
digitalguidebooks.com
greenglenhoa.com
yoursavvymoneyteen.com
andreaknightteacherauthor.com
deadcyber.com
theaudacity.agency
decorefy.com
3djackets.com
anchoredbody.com
toddlely.net
sreeboutiques.com
advocate4blind.com
reggiedulaney.com
troyguessford.com
catbateswellness.com
facemaskflavors.com
ruecedu.com
the1museum.com
studionimba.com
anaheimhillshomeprices.com
tectums.com
517txyg.com
midwestrant.com
empoweredcareerwoman.com
webparked.com
maihao.asia
math-general.com
g23a.com
drippyclothes.com
trendingpopic.com
teradeck.com
yaoniewg.com
tiendaloteria.com
qipaoweb.com
decay.life
mooli.info
bitepros.com
healthfirstorganic.com
superhosting.info
formationindia.com
boncho.site
vbc009.com
midwestresort.com
kings-trade.com
nastywomanforever.com
ellinamusic.com
molpit.com
wenshu-school.com
themassagebay.com
provf.info
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/4048-204-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/4048-208-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\F08HZ = "C:\\Program Files (x86)\\Bpzxlgz4x\\tvylifba0.exe" netsh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run netsh.exe -
Executes dropped EXE 1 IoCs
pid Process 4048 AddInProcess32.exe -
Loads dropped DLL 1 IoCs
pid Process 2872 243979694b054a96137dac617876bcdb_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2872 set thread context of 4048 2872 243979694b054a96137dac617876bcdb_JaffaCakes118.exe 85 PID 4048 set thread context of 3488 4048 AddInProcess32.exe 55 PID 3700 set thread context of 3488 3700 netsh.exe 55 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Bpzxlgz4x\tvylifba0.exe netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 243979694b054a96137dac617876bcdb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2951562807-3718269429-4208157415-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netsh.exe -
Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 2872 243979694b054a96137dac617876bcdb_JaffaCakes118.exe 4048 AddInProcess32.exe 4048 AddInProcess32.exe 4048 AddInProcess32.exe 4048 AddInProcess32.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4048 AddInProcess32.exe 4048 AddInProcess32.exe 4048 AddInProcess32.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe 3700 netsh.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2872 243979694b054a96137dac617876bcdb_JaffaCakes118.exe Token: SeDebugPrivilege 4048 AddInProcess32.exe Token: SeDebugPrivilege 3700 netsh.exe Token: SeShutdownPrivilege 3488 Explorer.EXE Token: SeCreatePagefilePrivilege 3488 Explorer.EXE Token: SeShutdownPrivilege 3488 Explorer.EXE Token: SeCreatePagefilePrivilege 3488 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2872 wrote to memory of 4048 2872 243979694b054a96137dac617876bcdb_JaffaCakes118.exe 85 PID 2872 wrote to memory of 4048 2872 243979694b054a96137dac617876bcdb_JaffaCakes118.exe 85 PID 2872 wrote to memory of 4048 2872 243979694b054a96137dac617876bcdb_JaffaCakes118.exe 85 PID 2872 wrote to memory of 4048 2872 243979694b054a96137dac617876bcdb_JaffaCakes118.exe 85 PID 2872 wrote to memory of 4048 2872 243979694b054a96137dac617876bcdb_JaffaCakes118.exe 85 PID 2872 wrote to memory of 4048 2872 243979694b054a96137dac617876bcdb_JaffaCakes118.exe 85 PID 3488 wrote to memory of 3700 3488 Explorer.EXE 86 PID 3488 wrote to memory of 3700 3488 Explorer.EXE 86 PID 3488 wrote to memory of 3700 3488 Explorer.EXE 86 PID 3700 wrote to memory of 636 3700 netsh.exe 87 PID 3700 wrote to memory of 636 3700 netsh.exe 87 PID 3700 wrote to memory of 636 3700 netsh.exe 87 PID 3700 wrote to memory of 3612 3700 netsh.exe 89 PID 3700 wrote to memory of 3612 3700 netsh.exe 89 PID 3700 wrote to memory of 3612 3700 netsh.exe 89 PID 3700 wrote to memory of 4604 3700 netsh.exe 91 PID 3700 wrote to memory of 4604 3700 netsh.exe 91 PID 3700 wrote to memory of 4604 3700 netsh.exe 91
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\243979694b054a96137dac617876bcdb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\243979694b054a96137dac617876bcdb_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:636
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
- System Location Discovery: System Language Discovery
PID:3612
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4604
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
Filesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
Filesize
40KB
MD5a182561a527f929489bf4b8f74f65cd7
SHA18cd6866594759711ea1836e86a5b7ca64ee8911f
SHA25642aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA5129bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
-
Filesize
83KB
MD57bdcf0242367969776c16f939a937d5b
SHA1012ad23871d6a2daefe4cfa59082a7f8159d784c
SHA256c0039c5614baaf1ade570c13af3830d4a3804c14c2241adfd5a9d307263f538a
SHA5128c473299b4ddb80ed052f0bc91c99ab4e5fa2a6cf319e5a7d88747461f9c7e0d65d3ff21ee429532c90024ce4ab17e43d67dd401a68fd6bd35b26952d118dbae
-
Filesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
Filesize
38B
MD54aadf49fed30e4c9b3fe4a3dd6445ebe
SHA11e332822167c6f351b99615eada2c30a538ff037
SHA25675034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
SHA512eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945
-
Filesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
Filesize
872B
MD5bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4