Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

a1d12749c3...18.exe

windows7-x64

10

a1d12749c3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 08:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a1d12749c3a445f9393c28d9ef398601_JaffaCakes118.exe

  • Size

    500KB

  • MD5

    a1d12749c3a445f9393c28d9ef398601

  • SHA1

    af107688fb96027dc74b2d44070f7fa9d5729af1

  • SHA256

    777ebce5c12dad3e68e572bfda63c887c9046769d8677ba150f6c2099b3eddc5

  • SHA512

    1139b402a1612a0931f13d811401b2e6a42a3826dfe0b078d968e92e531c0567e74d710f3f7ef8c51e52a6cadd1535924d9e5a4003a3377c6c87fda3c9876ce0

  • SSDEEP

    12288:Ge4IKQ7VTVeBANiEYA9i5gdCZQ3True/6/:Ge4IL7beBANiDgsFZQ3T

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 2 IoCs
    evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Drops file in System32 directory 10 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1d12749c3a445f9393c28d9ef398601_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a1d12749c3a445f9393c28d9ef398601_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /cregsvr32 C:\Windows\system32\Mswinsck.ocx /s
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:592
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 C:\Windows\system32\Mswinsck.ocx /s
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2160
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /cC:\Windows\system32\mistm.exe
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2312
      • C:\Windows\SysWOW64\mistm.exe
        C:\Windows\system32\mistm.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1424
        • C:\Windows\SysWOW64\wsvvrs.exe
          C:\Windows\system32\wsvvrs.exe
          4⤵
          • Modifies firewall policy service
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:2920
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /cC:\Users\Admin\AppData\Local\Temp\IMG0408A.jpg
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2972
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    PID:2832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IMG0408A.jpg
    Filesize

    61KB

    MD5

    a27289b4a906eb9b7da651190ddb88d5

    SHA1

    58ea61226ca137d546d28c999e3561b624b5faeb

    SHA256

    e60361d4c28e8602bcf54cc7433a2437cc0aa473fb0799a025800e0a33ddafbf

    SHA512

    94e671e4adff2872031b7150c1bb53311b0a9e9452b03c88bc15a84614bc99b982038b767db318e427e1d1e376196cf8f17e65c05bf5b25ebb2dcea90377ba7d

    Download Submit

  • C:\Windows\SysWOW64\Mswinsck.ocx
    Filesize

    121KB

    MD5

    e8a2190a9e8ee5e5d2e0b599bbf9dda6

    SHA1

    4e97bf9519c83835da9db309e61ec87ddf165167

    SHA256

    80ab0b86de58a657956b2a293bd9957f78e37e7383c86d6cd142208c153b6311

    SHA512

    57f8473eedaf7e8aad3b5bcbb16d373fd6aaec290c3230033fc50b5ec220e93520b8915c936e758bb19107429a49965516425350e012f8db0de6d4f6226b42ee

    Download Submit

  • C:\Windows\SysWOW64\leasrsa.dll
    Filesize

    76KB

    MD5

    6581e223325770d7a7a45d888c6e0b8a

    SHA1

    2573bea7321dcac7b8f509fd1fd2e479c52dd75c

    SHA256

    713bb82fc2a2cbcd062794914ffd3981c7d5c0e1045eba4c0146d9072541e2cc

    SHA512

    3b5270bd8c67477313d1247c0a89f8aee968faed78cbfe65abc68751ef00d7aa3158047669e5b7d20b893492ee54742329c74d5fee8206a60e8139d2e75b6d19

    Download Submit

  • C:\Windows\SysWOW64\nt010.info
    Filesize

    188KB

    MD5

    c36edb6c627328cd31063d525a9926a6

    SHA1

    a2a47fb580d2cce9d8a69eb884db6786e40191c4

    SHA256

    cb69eea72d23fcef8b6fa5cca691104c8a0f7ae8f03b5f2d520c2ad318920690

    SHA512

    88c091175d2df85ab423321f359f658a1c840c979be4b67204bc0a6e46499abd47d215b7b82d30f5a0ff814ccb284d909e8114880749d752b6a6d611d91ec93d

    Download Submit

  • C:\Windows\SysWOW64\nt011.info
    Filesize

    245B

    MD5

    ff159c5516ca511f60046cddad0ce07d

    SHA1

    11d2ff157d59e97dbadcdd3d56b3e38d868cdcf4

    SHA256

    874504c59bad46620bab90d647d5da0aa47cd3b2ce1de61e749cfe7c5c26f7e1

    SHA512

    a41fd6ed764f57f986687e1ee8a422dd5cbf1d0f0bc6269f9ea2689b216a7499a81160dc71da6e53dc165afde5f521af2c62d7186973cf558d45cf1ac3fea18a

    Download Submit

  • \Windows\SysWOW64\mistm.exe
    Filesize

    24KB

    MD5

    ee308ff62bf01e3687a4a26f230f965b

    SHA1

    dcb87daa5539c79232c72cd77bcbdde0db6cb401

    SHA256

    1a10f463040d79b3145beb04aef74bdd543231c19ad1ebe81ab1534b1eaf7d31

    SHA512

    9d2f65f6bea37640c8d8c559decdd0f3cfa2d7e092c7b2ef76e32b943c9dc97c938ecbb2ad1a661096673d77de83367248be2961ec8bfcd85b7b358b02f6b8e6

    Download Submit

  • memory/2832-67-0x0000000000160000-0x0000000000162000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2972-66-0x0000000002450000-0x0000000002452000-memory.dmp

    Filesize

    8KB

    Download