Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

a7df73fe92...18.exe

windows7-x64

7

a7df73fe92...18.exe

windows10-2004-x64

7

$TEMP/rjjmanpw.exe

windows7-x64

5

$TEMP/rjjmanpw.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 19:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a7df73fe928fbb26f29aeeb7a8b0a82b_JaffaCakes118.exe

  • Size

    104KB

  • MD5

    a7df73fe928fbb26f29aeeb7a8b0a82b

  • SHA1

    3795602954da5dae4a58745752416bfd323ab73c

  • SHA256

    1bc8659958762a59361560208c31dafce0a3c370cf2d5071b745fa2cb641b7b6

  • SHA512

    afef8400ac82a207e3fe4ea58173a3dd198ddc1042dbb9d8152c6a343aa894d34f00076979aad1ffe15e70fee18ecb9e0a2b33e0dceac9b56e50c459bad0d80a

  • SSDEEP

    3072:4gXdZt9P6D3XJcM5tSGagNxOTSZWki3VJWk1BSqeJq7DxKP13LvP:4e34f7l9xYSZPe6sBSqeEPxI1rP

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7df73fe928fbb26f29aeeb7a8b0a82b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a7df73fe928fbb26f29aeeb7a8b0a82b_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4172
    • C:\Users\Admin\AppData\Local\Temp\rjjmanpw.exe
      C:\Users\Admin\AppData\Local\Temp\rjjmanpw.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3120
      • C:\Users\Admin\AppData\Local\Temp\rjjmanpw.exe
        C:\Users\Admin\AppData\Local\Temp\rjjmanpw.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2344
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:784
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:436 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1724
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1372
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1372 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3672
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1472
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1472 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4528
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4220
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:5004
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B9AWTLKS\dnserror[1]
    Filesize

    2KB

    MD5

    2dc61eb461da1436f5d22bce51425660

    SHA1

    e1b79bcab0f073868079d807faec669596dc46c1

    SHA256

    acdeb4966289b6ce46ecc879531f85e9c6f94b718aab521d38e2e00f7f7f7993

    SHA512

    a88becb4fbddc5afc55e4dc0135af714a3eec4a63810ae5a989f2cecb824a686165d3cedb8cbd8f35c7e5b9f4136c29dea32736aabb451fe8088b978b493ac6d

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H9MX5QVK\httpErrorPagesScripts[1]
    Filesize

    11KB

    MD5

    9234071287e637f85d721463c488704c

    SHA1

    cca09b1e0fba38ba29d3972ed8dcecefdef8c152

    SHA256

    65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

    SHA512

    87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KQ3665LB\down[1]
    Filesize

    748B

    MD5

    c4f558c4c8b56858f15c09037cd6625a

    SHA1

    ee497cc061d6a7a59bb66defea65f9a8145ba240

    SHA256

    39e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781

    SHA512

    d60353d3fbea2992d96795ba30b20727b022b9164b2094b922921d33ca7ce1634713693ac191f8f5708954544f7648f4840bcd5b62cb6a032ef292a8b0e52a44

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KQ3665LB\errorPageStrings[1]
    Filesize

    4KB

    MD5

    d65ec06f21c379c87040b83cc1abac6b

    SHA1

    208d0a0bb775661758394be7e4afb18357e46c8b

    SHA256

    a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

    SHA512

    8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T369AOZZ\NewErrorPageTemplate[1]
    Filesize

    1KB

    MD5

    dfeabde84792228093a5a270352395b6

    SHA1

    e41258c9576721025926326f76063c2305586f76

    SHA256

    77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075

    SHA512

    e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\rjjmanpw.exe
    Filesize

    128KB

    MD5

    c8ad9f49632247cf36173e5c6f225882

    SHA1

    1bda98f1c454db6bb27ea50d6731a9034f588758

    SHA256

    f0e1a2a2c83d352691c0b5b2ce9c53920d3a0457ddf20e3648b0f01ed2d24215

    SHA512

    aad1232869c55e09fda2567ff979631102d217ba7245b35f627d805250b0497fc3c74fc8e2d3938c452abe4e7a2311effa0316fce9f7c8c0a030d44b0a99f6da

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\setup.dat
    Filesize

    29KB

    MD5

    a3910dabffcf1940d442f936b1715fcb

    SHA1

    af38ae5ff3f4428264e8ff83905b4b4ffb1ea230

    SHA256

    8ce6d97e44ed38d8475194903e5f84a30aa83844b8c39862c6287597f3a72fb5

    SHA512

    9406fb768b3be06727c0b0d411a20d3a2bd0ac1c77986846feb25e5e7ebb16ce2aa895d1eec58314c1d981fc4b8033bc1069bfbaba792937ccbe529cf68cc303

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\~DF0DFBED7A611B0E50.TMP
    Filesize

    16KB

    MD5

    b11b656c5d925c67474a13655f771c03

    SHA1

    2648179064ca34f7580045af045a4009b38c94bd

    SHA256

    8dada45d38f095beaf5b3524a0fc0c7626809da970c0b0325a016e40be5ec929

    SHA512

    7dffaeb399188d24b84890ee68048cf7f609f0b075880fd1fb24fa2fcb80db7a818b5ef168d7b0d1125952d6b9757e3a3699e8a03f1ff5fc9da04e89a2e8788d

    Download Submit

  • memory/2344-8-0x0000000000400000-0x0000000000404000-memory.dmp

    Filesize

    16KB

    Download

  • memory/2344-11-0x0000000000400000-0x0000000000404000-memory.dmp

    Filesize

    16KB

    Download

  • memory/2344-13-0x0000000010000000-0x000000001000E000-memory.dmp

    Filesize

    56KB

    Download