Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

89df615288...18.exe

windows7-x64

7

89df615288...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 09:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    89df6152889fd5b561772d22e2171703_JaffaCakes118.exe

  • Size

    857KB

  • MD5

    89df6152889fd5b561772d22e2171703

  • SHA1

    9a1d4b24579a9cf6c9692d1d2595123c253ed24e

  • SHA256

    62a4aa6e6e0c4df7b32f8b4d6bd52eca1b98e0b9637ba3d437fbb77f413b6c4b

  • SHA512

    fc0abc93477b7dc34dac722e7e6a2bd02c307dc94428320a2673a2b4643a8865a0a71cfc12ddb3541873f31b060ac805446e2175ba421e3159c44cf031c23bb8

  • SSDEEP

    24576:lBy06cUfLdB5bapl/Zumq8qgGYPCQ0cBIUKw5vkKR:jy06rLdB5b0jq8qmpDBLH5

Score
8/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 33 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\89df6152889fd5b561772d22e2171703_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\89df6152889fd5b561772d22e2171703_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\ProgramData\isecurity.exe
      C:\ProgramData\isecurity.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4620
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 876
        3⤵
        • Program crash
        PID:2700
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 924
        3⤵
        • Program crash
        PID:5116
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1152
        3⤵
        • Program crash
        PID:4724
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1160
        3⤵
        • Program crash
        PID:1428
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1208
        3⤵
        • Program crash
        PID:2836
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1204
        3⤵
        • Program crash
        PID:4272
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1296
        3⤵
        • Program crash
        PID:2344
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1296
        3⤵
        • Program crash
        PID:5036
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1376
        3⤵
        • Program crash
        PID:4172
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1788
        3⤵
        • Program crash
        PID:4268
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1216
        3⤵
        • Program crash
        PID:2804
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4620 -ip 4620
    1⤵
      PID:2088
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4620 -ip 4620
      1⤵
        PID:4352
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4620 -ip 4620
        1⤵
          PID:1836
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4620 -ip 4620
          1⤵
            PID:5040
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4620 -ip 4620
            1⤵
              PID:3024
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4620 -ip 4620
              1⤵
                PID:2400
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4620 -ip 4620
                1⤵
                  PID:3296
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4620 -ip 4620
                  1⤵
                    PID:4640
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4620 -ip 4620
                    1⤵
                      PID:2716
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Modifies registry class
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:2816
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:1132
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:1300
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:4048
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:4324
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:3684
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3780
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SendNotifyMessage
                        PID:648
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1464
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SendNotifyMessage
                        PID:2760
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4396
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        PID:3008
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:3248
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        PID:3760
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4804
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:632
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4620 -ip 4620
                      1⤵
                        PID:4444
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4620 -ip 4620
                        1⤵
                          PID:3448

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\isecurity.exe
                          Filesize

                          848KB

                          MD5

                          aa3d86e9412f666c757f8f863ce20cf2

                          SHA1

                          ef0033b6b4abc9d0238910e639d2bffa7ffff157

                          SHA256

                          fd6f51babe86c8b4b66907c5a2248ffe8f4cf2e2833c279f26fe3893ecae2ab1

                          SHA512

                          267d64575193453ba1bf1152f4030247140b562bc6ccfbc3b711db9a91c05d28d28f9231670855be92b8a98281d2a47c192548d9808f6243cfd2b5601b6f5f92

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                          Filesize

                          471B

                          MD5

                          eaa327a444d7f3489550986d9fa94b4a

                          SHA1

                          894b0bc575dbb6c9ce2f0e866b7695728d7118e8

                          SHA256

                          98be7f507291fe723327a4eb2c88c13b4510099facdcd4c934aee3a2f7ec3d6f

                          SHA512

                          3de08cef116e376e58ce9a79226e8bba3e3cfc90272c2ce91b92a44a56c2e44fe7119f35a5c3b4977238948ec09233c6851a8e319471dd252f355252b9a0d661

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                          Filesize

                          420B

                          MD5

                          f8ba11e029e508717d4dde53eaace585

                          SHA1

                          9e7f0dec12663f95195f9842b0166f867a684726

                          SHA256

                          658cf87049e19274dfb3c3b5bc5607d671cd9318d1d19f209440dbaf05f1d885

                          SHA512

                          3cc192d1dfc57138241996d7df58c8ad813f780e194ede583a1b75529cef6fbce6ee6f977017fba5f7aa997978670d145f7960ab30729e91801c2858bb5af255

                          Download Submit

                        • C:\Users\Admin\AppData\Local\IconCache.db
                          Filesize

                          16KB

                          MD5

                          38002dba7b0a0c07d810c0d13f991f13

                          SHA1

                          9635c25cbf23de28a82073118de7d725356e623e

                          SHA256

                          8908041cc022532c6b229a74651bb956a68123f0781c67dd7a4e712eb2937d8b

                          SHA512

                          9848500272aec218a503eb98a4eb3771e83a74e0d73f73bdbc4cbbc058ab99c4c39cd2b23341870145fa5f912403cc5bcddde5268d3a3e7982c8e2fb4d1656b8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                          Filesize

                          1022B

                          MD5

                          65ee7fad1fe20ccb6a22a24e70566bba

                          SHA1

                          2cbccd6a828d5198f85bd385f6bf0ac8777d4144

                          SHA256

                          4aaaee2fbdb2405015b0085675aa922f16c3f41eb0ae91f0fc7a34fa0751a090

                          SHA512

                          efb95249fd9f7b4f29825c302b4db556b8f5a749ec620e726905c3883948af12261187a4bef85c9584324ae12108a834d69f8f7f56839f5834ab49fc647d44b3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133678426200078556.txt
                          Filesize

                          75KB

                          MD5

                          263960904fcb1c46cc216bd860eb0240

                          SHA1

                          57b1f6a4dceb07eebc008d41f4b21c3aa1d554e4

                          SHA256

                          bf9f2ea1d49864a9c1dfe096dbcfd1e1f262e6223615bf8cc4ec786f19b37c28

                          SHA512

                          5b52d8b705cc043a7802d918500601e05f1e676752864daecdb7515ba2603e8840d2bb384a710fd85803a5cb72c80cc1e9655407627bd9e6715f905215f1ca8f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\{AFE0F8D0-E367-40D8-9658-3446921A199C}.png
                          Filesize

                          6KB

                          MD5

                          099ba37f81c044f6b2609537fdb7d872

                          SHA1

                          470ef859afbce52c017874d77c1695b7b0f9cb87

                          SHA256

                          8c98c856e4d43f705ff9a5c9a55f92e1885765654912b4c75385c3ea2fdef4a7

                          SHA512

                          837e1ad7fe4f5cbc0a87f3703ba211c18f32b20df93b23f681cbd0390d8077adba64cf6454a1bb28df1f7df4cb2cdc021d826b6ef8db890e40f21d618d5eb07a

                          Download Submit

                        • C:\Users\Public\Desktop\Internet Security.lnk
                          Filesize

                          682B

                          MD5

                          317046125a74f7f8e0932aa216be4991

                          SHA1

                          16f7a56fce2ff388078703e3a9fc574873d7f454

                          SHA256

                          06eb2a09bc42d1df94c839099dd137b4bf332304af2f3d4881c29e3eb7a8dcee

                          SHA512

                          4bc31e1528f35eb1208215e161a001e4ff8defc9c63d9b37a8377de2e3644df8e467b35a18344a4ac1084418dd7144236cc5d283a09779064bb35e7b9d226041

                          Download Submit

                        • memory/632-180-0x0000000004020000-0x0000000004021000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/648-162-0x00000000046E0000-0x00000000046E1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/796-1-0x0000000000400000-0x0000000000507000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/796-7-0x0000000000400000-0x0000000000507000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/796-2-0x0000000000400000-0x0000000000507000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/796-0-0x0000000000401000-0x0000000000403000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/1132-27-0x0000000003F10000-0x0000000003F11000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3760-174-0x0000000004560000-0x0000000004561000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4324-34-0x000001542C590000-0x000001542C5B0000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/4324-56-0x000001542C960000-0x000001542C980000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/4324-45-0x000001542C550000-0x000001542C570000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/4620-20-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-192-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-18-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-163-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-17-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-16-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-14-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-182-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-183-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-185-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-184-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-19-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-193-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-200-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-201-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-202-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-203-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-208-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-209-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-210-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-213-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-214-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-215-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/4620-216-0x0000000000400000-0x0000000000A40000-memory.dmp

                          Filesize

                          6.2MB

                          Download