Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 13:35

General

  • Target

    c0db96aabaac2dff796ebcab5e29c9e9_JaffaCakes118.exe

  • Size

    255KB

  • MD5

    c0db96aabaac2dff796ebcab5e29c9e9

  • SHA1

    89e8a3a36cd167dfbf1ba66c3d613c85eb967f5b

  • SHA256

    8e707874e515833aa45dac24aaf1ddb66c5901384b2396f73217f711340b3859

  • SHA512

    2bdbf024b6a1305a3070f2b92711f936c4827a5f9dd560c4620e2c8d5fccf573b5e76ed0c3c08cb719a5aef59074ad1ad837f60ff6c8ceb4808d8a05c1bad516

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJD:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIg

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 59 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c0db96aabaac2dff796ebcab5e29c9e9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c0db96aabaac2dff796ebcab5e29c9e9_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Windows\SysWOW64\ghqwmuruhb.exe
      ghqwmuruhb.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3928
      • C:\Windows\SysWOW64\vjzxlhyj.exe
        C:\Windows\system32\vjzxlhyj.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:220
    • C:\Windows\SysWOW64\ytgqiwdlrrxicta.exe
      ytgqiwdlrrxicta.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2076
    • C:\Windows\SysWOW64\vjzxlhyj.exe
      vjzxlhyj.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4312
    • C:\Windows\SysWOW64\ycuirxwpqukad.exe
      ycuirxwpqukad.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4280
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    255KB

    MD5

    98af01cfd36f1b52a4e0367de1e6cfa4

    SHA1

    20be9e6274f7ad4b9834e65e57b6800f00970d06

    SHA256

    ddec350b58b1a3f220d2cc57cb4651912dc877cf64bd620c95ba25e0cb97b862

    SHA512

    8e7622fdea6d823699b63fdd8e24f573298bd6b628970cbf0fa1c927f5ee2cb72fe753e64096829e0eff47274f2fb6023a31271a028e055f6710509c01a980fa

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    255KB

    MD5

    ce88f5b6c241f36e9a60ff07c7f53c72

    SHA1

    08c65d47fc9e7d6454317eb685a77548f9f2b348

    SHA256

    45198c347089187177811d059c28cc845dc3ed0ff2d1fe22011c72d609f7b568

    SHA512

    ae37a6fa098a54e0280d6ba54cd407f7cb7ff3ef3543ce5f95ffcfcb7c4d80780cab9a0e013c7b9eefd89fbcc896b4a94fd7e2a41725cde190470c57a1a692ab

  • C:\Users\Admin\AppData\Local\Temp\TCD28A5.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    385B

    MD5

    f3406dab0f69d2da7d8447339d538234

    SHA1

    3fda315d6e60df23000be925c1f4f92e59d9f6fb

    SHA256

    73b55d764783f71ae8f653ff9b59b7653b36af3415a2508820354fd89f3d46a0

    SHA512

    1aef6f9ee71df5ae295953d1b5709fcb88bb1ea241c8a5896de25461660cf20757c2fedb5eef2644a611b57e7428ec9a023fb6cace0c17cc92ae9907a73a7cba

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    b30493b7fb5dfead411c5c1372444eac

    SHA1

    28f04b328f096f52d4200a2dd2aeafbc270092e8

    SHA256

    de5a2a259d632f3a79fece6f7f739844bd57a4cb61759b7debe380e0de188cff

    SHA512

    1f5c206ad26c2b826cfcc6c5af4e86517bad400ed85794350151062b834a95d400f997028a4b51daac6763713837a7760f79004b9a3bde59b53dc78c4e868f96

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    2KB

    MD5

    54e7bd204341754051944d7249168955

    SHA1

    97f8ab5aa0c09722444577301deca64b652f8fcc

    SHA256

    4d7c7dcbe22d6521dc6d64396bca77f5bef95789b1fdd65ca52fd4b506c8fcac

    SHA512

    62e628090c9b93ff26c70ffc1814f941b7cc976c5f5f111acc575358c1625557d229f76b3b6f6f3a1f63e56a97f7596c6ccddeaced0e0c2e0d8456289ab96f80

  • C:\Users\Admin\AppData\Roaming\RestoreFind.doc.exe

    Filesize

    255KB

    MD5

    affb23d88098c056ad17a7dcfffae4e6

    SHA1

    cc0f50cc9e3cf5aae1bb73651977e2480a58da58

    SHA256

    9b8bcb3035b049251fd661836ec04cff2c867f4242a797638ab373d672ab039a

    SHA512

    ccc9c35521c9dc67d7dcedb52f77e1d05ac8dc831c198ae800b4b1cdcc04a524484c651bfaf3b0ac797a2062995ba17b04ec0b47fc4589e9fbb1ff14d97139bd

  • C:\Windows\SysWOW64\ghqwmuruhb.exe

    Filesize

    255KB

    MD5

    4a7ccb7486c11dcdfebb9cda75e93e6f

    SHA1

    669108902f103951fb74d9f34852105d1e043642

    SHA256

    b05ce59aa7abe79b6ceee8eefa7ca999ec2b95b6ccd33336a5b5fa5850a9b189

    SHA512

    f6d36e845a4ac0e700c63a1b4bb840c6095e586dcd3b2c63e21aeb6c5c5ccfc777575cb41a7c1e52a6e2f17e9c9588bf97028732e09f793eed65f2478e2cee00

  • C:\Windows\SysWOW64\vjzxlhyj.exe

    Filesize

    255KB

    MD5

    692dac5b24378a54968c520255ba897c

    SHA1

    38962c945db570870ec2e5ac1e21162de1e8b846

    SHA256

    7ef781e3538c9becbb5c25100272fcf45832fef2cd5d47e8ce365dedb6310d02

    SHA512

    b7c79c5e2a13389c682e34bfd4aa3d24158ea0f1718b963c3b606d3a48fdebc51e26379405a0d7f5687e93d011ae9dcedb745e558ef172c3d5302e6b4f327c43

  • C:\Windows\SysWOW64\ycuirxwpqukad.exe

    Filesize

    255KB

    MD5

    7b5e769383705d32ea5326ea3434704c

    SHA1

    b54eb6f87556d594836f37a29701cfbfe6b48506

    SHA256

    ae3c05db41e00079684805c73b2b1bd81c809017a022a2b19b2b65198864fc76

    SHA512

    16ce45a4aac324a2f4c9369e95f41f364ebd483643bdbadb2f7b1e8b453b093ee7d972d7202eca5791a49dc4ff51ce8e750a9521fab872ac6850919eb6e6aef0

  • C:\Windows\SysWOW64\ytgqiwdlrrxicta.exe

    Filesize

    255KB

    MD5

    de4fe928e4954407c1fe6f29d71a3cdc

    SHA1

    dfe6c949f093515d7eccac6b73fdae4871594d5b

    SHA256

    09a867cb2de8d51a405bf2cb247b86f121e36ccc2e2004ba86ac682f4cacf7dc

    SHA512

    944ade4f3498997d891ad50aa9d92919aaf75128aabe391118cb0ef4975b637f2c2f074d197becd227913b3559845caee9792b4481a7b7c1eb7ac2c59f00ce32

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    255KB

    MD5

    4af6d0ef0ae0e339e8c825be10bb84f1

    SHA1

    2038cf3b2880cf6b0a5c27d2faced907b0f62571

    SHA256

    90ee3b60cbdaec7c44144804bd49614c48cb9bd349d19e72c42a6c5d69bc50f8

    SHA512

    0561728a3fd444b6a314eaa97f17ca9c36eacc6cb6603162439c23d41a38fe475c017c6808a19bb7856da45d0704d9f92fbd5a30c85f6ec17328e04ca049eaf8

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    255KB

    MD5

    887e5f837445c34b73270327fb890656

    SHA1

    48144e2828fbbb8033754932b6eb103a51218dc9

    SHA256

    f5f1a2cc10eaf1168c0e0471c2c530cf22b5f119287ab8458c2299204fe15cea

    SHA512

    de1ccaa24bbb722c2a6f88b2ce4257d473e10ef319bb58ae9565941abc7b2cc368891eefd4a6cdaa2e9fb83db163f2a9849ebf8f75122ee7a55d2a28df833aea

  • memory/220-41-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/220-97-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/220-98-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/220-605-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/220-610-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/220-618-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/220-615-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-665-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-94-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-668-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-671-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-612-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-27-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-621-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-624-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-90-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-602-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-674-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-607-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-632-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-654-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-635-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2076-638-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2548-34-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2548-0-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3752-661-0x00007FFA6E490000-0x00007FFA6E4A0000-memory.dmp

    Filesize

    64KB

  • memory/3752-660-0x00007FFA6E490000-0x00007FFA6E4A0000-memory.dmp

    Filesize

    64KB

  • memory/3752-35-0x00007FFA6E490000-0x00007FFA6E4A0000-memory.dmp

    Filesize

    64KB

  • memory/3752-37-0x00007FFA6E490000-0x00007FFA6E4A0000-memory.dmp

    Filesize

    64KB

  • memory/3752-36-0x00007FFA6E490000-0x00007FFA6E4A0000-memory.dmp

    Filesize

    64KB

  • memory/3752-38-0x00007FFA6E490000-0x00007FFA6E4A0000-memory.dmp

    Filesize

    64KB

  • memory/3752-39-0x00007FFA6E490000-0x00007FFA6E4A0000-memory.dmp

    Filesize

    64KB

  • memory/3752-42-0x00007FFA6BBC0000-0x00007FFA6BBD0000-memory.dmp

    Filesize

    64KB

  • memory/3752-43-0x00007FFA6BBC0000-0x00007FFA6BBD0000-memory.dmp

    Filesize

    64KB

  • memory/3752-663-0x00007FFA6E490000-0x00007FFA6E4A0000-memory.dmp

    Filesize

    64KB

  • memory/3752-662-0x00007FFA6E490000-0x00007FFA6E4A0000-memory.dmp

    Filesize

    64KB

  • memory/3928-634-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-664-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-673-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-620-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-670-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-83-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-623-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-611-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-667-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-93-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-653-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-631-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-601-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-637-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3928-606-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-669-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-672-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-609-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-604-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-633-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-655-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-31-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-96-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-614-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-622-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-636-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-666-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-92-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-639-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4280-625-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4312-91-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4312-619-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4312-608-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4312-95-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4312-613-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4312-603-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB