Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/07/2024, 21:13

General

  • Target

    243979694b054a96137dac617876bcdb_JaffaCakes118.exe

  • Size

    510KB

  • MD5

    243979694b054a96137dac617876bcdb

  • SHA1

    f9c429224a786fb11bb4e12a50823a1e7f035745

  • SHA256

    3566accfc4308a1d6b1a76c175664f4cbd7e0e542f323a252faf325b77bc8edf

  • SHA512

    29e03b97294dd4e30c68851c732a097b2cde0c1098aad5760a8ad2c80fabd6151feead15c2f48a12a3eee3266861a814bd3837af7e39144d7e376aa7ffdb3921

  • SSDEEP

    12288:458WhWmNEYOyFeMG9b/KxiCWom2pBm5ic6g6MmMrcIdsGC9:45dxNDE9bKxzWo0cWC9

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dmn

Decoy

makemecookies.com

highlandseniorcare.com

artnowmedia.com

realmusicschool.com

daporn.pro

xn--meditaoevida-7bb9c.com

uniqueskinproducts.com

xmoncatto.com

shaloutuan.com

mixednotshaken.com

pulseslondonuk.com

bestkeptsecretportland.com

xpj888n.com

natureswayentertainment.net

alkhemilia.com

digitalguidebooks.com

greenglenhoa.com

yoursavvymoneyteen.com

andreaknightteacherauthor.com

deadcyber.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Formbook payload 2 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3488
    • C:\Users\Admin\AppData\Local\Temp\243979694b054a96137dac617876bcdb_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\243979694b054a96137dac617876bcdb_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
        "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4048
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\SysWOW64\netsh.exe"
      2⤵
      • Adds policy Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3700
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:636
      • C:\Windows\SysWOW64\cmd.exe
        /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3612
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:4604

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\4acacee3-cefe-4dab-b6f1-01f9a63ec79a\e.dll

      Filesize

      94KB

      MD5

      14ff402962ad21b78ae0b4c43cd1f194

      SHA1

      f8a510eb26666e875a5bdd1cadad40602763ad72

      SHA256

      fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

      SHA512

      daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

    • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

      Filesize

      42KB

      MD5

      9827ff3cdf4b83f9c86354606736ca9c

      SHA1

      e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723

      SHA256

      c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a

      SHA512

      8261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579

    • C:\Users\Admin\AppData\Local\Temp\DB1

      Filesize

      40KB

      MD5

      a182561a527f929489bf4b8f74f65cd7

      SHA1

      8cd6866594759711ea1836e86a5b7ca64ee8911f

      SHA256

      42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

      SHA512

      9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

    • C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogim.jpeg

      Filesize

      83KB

      MD5

      7bdcf0242367969776c16f939a937d5b

      SHA1

      012ad23871d6a2daefe4cfa59082a7f8159d784c

      SHA256

      c0039c5614baaf1ade570c13af3830d4a3804c14c2241adfd5a9d307263f538a

      SHA512

      8c473299b4ddb80ed052f0bc91c99ab4e5fa2a6cf319e5a7d88747461f9c7e0d65d3ff21ee429532c90024ce4ab17e43d67dd401a68fd6bd35b26952d118dbae

    • C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogrf.ini

      Filesize

      40B

      MD5

      2f245469795b865bdd1b956c23d7893d

      SHA1

      6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

      SHA256

      1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

      SHA512

      909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

    • C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogrg.ini

      Filesize

      38B

      MD5

      4aadf49fed30e4c9b3fe4a3dd6445ebe

      SHA1

      1e332822167c6f351b99615eada2c30a538ff037

      SHA256

      75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

      SHA512

      eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

    • C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogri.ini

      Filesize

      40B

      MD5

      d63a82e5d81e02e399090af26db0b9cb

      SHA1

      91d0014c8f54743bba141fd60c9d963f869d76c9

      SHA256

      eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

      SHA512

      38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

    • C:\Users\Admin\AppData\Roaming\4KO83O42\4KOlogrv.ini

      Filesize

      872B

      MD5

      bbc41c78bae6c71e63cb544a6a284d94

      SHA1

      33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

      SHA256

      ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

      SHA512

      0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

    • memory/2872-22-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-14-0x00000000731C0000-0x0000000073249000-memory.dmp

      Filesize

      548KB

    • memory/2872-72-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-70-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-68-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-64-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-62-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-61-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-58-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-56-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-54-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-53-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-51-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-48-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-46-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-44-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-42-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-40-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-38-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-36-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-35-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-24-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-0-0x000000007473E000-0x000000007473F000-memory.dmp

      Filesize

      4KB

    • memory/2872-20-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-18-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-16-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-15-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-74-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-32-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-30-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-28-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-26-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-76-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-195-0x000000007473E000-0x000000007473F000-memory.dmp

      Filesize

      4KB

    • memory/2872-196-0x0000000074730000-0x0000000074EE0000-memory.dmp

      Filesize

      7.7MB

    • memory/2872-197-0x0000000074730000-0x0000000074EE0000-memory.dmp

      Filesize

      7.7MB

    • memory/2872-199-0x0000000006A60000-0x0000000006A6C000-memory.dmp

      Filesize

      48KB

    • memory/2872-66-0x0000000002690000-0x00000000026B5000-memory.dmp

      Filesize

      148KB

    • memory/2872-1-0x0000000000340000-0x00000000003C6000-memory.dmp

      Filesize

      536KB

    • memory/2872-205-0x0000000074730000-0x0000000074EE0000-memory.dmp

      Filesize

      7.7MB

    • memory/2872-2-0x0000000074730000-0x0000000074EE0000-memory.dmp

      Filesize

      7.7MB

    • memory/2872-3-0x0000000002690000-0x00000000026BC000-memory.dmp

      Filesize

      176KB

    • memory/2872-4-0x00000000053E0000-0x0000000005984000-memory.dmp

      Filesize

      5.6MB

    • memory/2872-5-0x0000000004D60000-0x0000000004DA4000-memory.dmp

      Filesize

      272KB

    • memory/2872-6-0x0000000004ED0000-0x0000000004F62000-memory.dmp

      Filesize

      584KB

    • memory/3488-217-0x0000000002B10000-0x0000000002BE6000-memory.dmp

      Filesize

      856KB

    • memory/3488-220-0x0000000008080000-0x00000000081C8000-memory.dmp

      Filesize

      1.3MB

    • memory/3488-224-0x0000000008080000-0x00000000081C8000-memory.dmp

      Filesize

      1.3MB

    • memory/3488-210-0x0000000002B10000-0x0000000002BE6000-memory.dmp

      Filesize

      856KB

    • memory/3700-214-0x00000000009A0000-0x00000000009BE000-memory.dmp

      Filesize

      120KB

    • memory/4048-206-0x00000000014B0000-0x00000000017FA000-memory.dmp

      Filesize

      3.3MB

    • memory/4048-208-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/4048-209-0x0000000000FF0000-0x0000000001004000-memory.dmp

      Filesize

      80KB

    • memory/4048-204-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB