Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 04:19

General

  • Target

    cea2d53f3741c750f8da141ce3044b9c_JaffaCakes118.exe

  • Size

    548KB

  • MD5

    cea2d53f3741c750f8da141ce3044b9c

  • SHA1

    e4c40c26e0556447cbb8c5731aa3b4fe9a1e9399

  • SHA256

    059da1d4aca3dac5c4e827e9e7a5ebd07e3b3581135c200cdcb7c5e9be5065e3

  • SHA512

    36067bd002f52ea95d6eb2d2a84808a879bc0af619938ade50b2bb08fe440af897815b5066c89fbe7383f99f08a77449fdfd0524636b22a500117d3c17fec615

  • SSDEEP

    12288:e9dVKCxkIgeqXqXBb9P3BpcLLWW7HMwBIMQxlskGljE3af6EJ:yXKCFgeCqXBN3MswjQxkJ

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cea2d53f3741c750f8da141ce3044b9c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cea2d53f3741c750f8da141ce3044b9c_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Users\Admin\AppData\Local\Temp\Or's industry\PairBusy.exe
      "C:\Users\Admin\AppData\Local\Temp\Or's industry\PairBusy.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1848
      • C:\Users\Admin\AppData\Local\Temp\Or's industry\PairBusy.exe
        "C:\Users\Admin\AppData\Local\Temp\Or's industry\PairBusy.exe"
        3⤵
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3920
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4212,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:8
    1⤵
      PID:2260

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Or's industry\PairBusy.exe

      Filesize

      548KB

      MD5

      cea2d53f3741c750f8da141ce3044b9c

      SHA1

      e4c40c26e0556447cbb8c5731aa3b4fe9a1e9399

      SHA256

      059da1d4aca3dac5c4e827e9e7a5ebd07e3b3581135c200cdcb7c5e9be5065e3

      SHA512

      36067bd002f52ea95d6eb2d2a84808a879bc0af619938ade50b2bb08fe440af897815b5066c89fbe7383f99f08a77449fdfd0524636b22a500117d3c17fec615

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Against Down.lnk

      Filesize

      1KB

      MD5

      fa42e0a3b07c40519286b9c710afc66c

      SHA1

      717acbf04062acaff961b625d3f36cbaef6c76f7

      SHA256

      dc857407676edbf7e6b2422e833db8c1120e61f79e59c4b82d141de532e85cfa

      SHA512

      add34498f32fbfb239bb1db6d548e66eee0b5d7a7874c4a24c3b969ac56c61e44e4136cf04828684173153913d621b3678b9ee97dfd0b3f8649595c300d9f87c

    • memory/636-0-0x00000000745B2000-0x00000000745B3000-memory.dmp

      Filesize

      4KB

    • memory/636-1-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/636-2-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/636-5-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/636-7-0x00000000745B2000-0x00000000745B3000-memory.dmp

      Filesize

      4KB

    • memory/636-8-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/636-9-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/636-24-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/1848-26-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/1848-27-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/1848-25-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/1848-29-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/1848-40-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/1848-41-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/1848-42-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/1848-45-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/3920-31-0x0000000000400000-0x0000000000452000-memory.dmp

      Filesize

      328KB

    • memory/3920-36-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB

    • memory/3920-46-0x00000000745B0000-0x0000000074B61000-memory.dmp

      Filesize

      5.7MB