Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/09/2024, 11:59

General

  • Target

    d44f35410ed96fba5fba1d6b96a6792b_JaffaCakes118.exe

  • Size

    96KB

  • MD5

    d44f35410ed96fba5fba1d6b96a6792b

  • SHA1

    80e79390ee9d4d6c45954d77e0f68cac6eacd673

  • SHA256

    1cbdd24a3d56a72c4c61e93ec680a19c5a58574e1a664fdaae224abdb825209b

  • SHA512

    e723f590b08acc6c3c201db6e889f48c70e5bc196f08492e4c09cda16817940d6588760c21a8c3bd81f88de687f30defc20358a5747492b12430015abbe8d8b3

  • SSDEEP

    1536:uTuSIEP4HSkGcuuIZSeGccOF6jh4+avyD8G/IGebr5AV4RR5efqvpsMym0Xi6cMV:u6MP4y1FSu+1D8NGepAVCRkfqvps9yx2

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d44f35410ed96fba5fba1d6b96a6792b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d44f35410ed96fba5fba1d6b96a6792b_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\Users\Admin\AppData\Roaming\Repupl.exe
      "C:\Users\Admin\AppData\Roaming\Repupl.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4688
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4688 CREDAT:17410 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2356
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4228

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      471B

      MD5

      7f9b88e0292691833018388229acfbfa

      SHA1

      50e3d82743913a3f81313549c45dab1ebc3bd69a

      SHA256

      2b930c9f3a0fff3fec9effa7f5d159d5b5c81465a1e23cf040cbcd6ab085b119

      SHA512

      e74cc60bceecdcbe66a67f62921daad7de864d20de476a3a18484b811ba97d1cafe702c2eacb6ba432119186db27f76ffc0fc692fd320d0c0228ec5d598c68a8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      404B

      MD5

      b5f6f48923d5a49dfb19808ef8b09b0e

      SHA1

      0737ce6aa265a5815fc2470225b0c6a78409aa94

      SHA256

      626d1d9309d10d9a3a0c1aceaa120b7a0c1abb1ef4f6c095c8e21908f805e523

      SHA512

      fac4b350d68674831421ff7fcc4477696790533407d8c5f0b675d4780953fb088c631beade872e80149115a49db17aec75710552e786a4dc0e6f39867c133bb0

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver4447.tmp

      Filesize

      15KB

      MD5

      1a545d0052b581fbb2ab4c52133846bc

      SHA1

      62f3266a9b9925cd6d98658b92adec673cbe3dd3

      SHA256

      557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

      SHA512

      bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GENTSNHI\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    • C:\Users\Admin\AppData\Roaming\Repupl.exe

      Filesize

      96KB

      MD5

      d44f35410ed96fba5fba1d6b96a6792b

      SHA1

      80e79390ee9d4d6c45954d77e0f68cac6eacd673

      SHA256

      1cbdd24a3d56a72c4c61e93ec680a19c5a58574e1a664fdaae224abdb825209b

      SHA512

      e723f590b08acc6c3c201db6e889f48c70e5bc196f08492e4c09cda16817940d6588760c21a8c3bd81f88de687f30defc20358a5747492b12430015abbe8d8b3

    • memory/2832-16-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2832-19-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2832-18-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2832-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2832-14-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4816-3-0x000000000040B000-0x0000000000411000-memory.dmp

      Filesize

      24KB

    • memory/4816-11-0x00000000006E0000-0x00000000006EE000-memory.dmp

      Filesize

      56KB

    • memory/4816-12-0x000000000040B000-0x0000000000411000-memory.dmp

      Filesize

      24KB

    • memory/4816-13-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4816-0-0x00000000006E0000-0x00000000006EE000-memory.dmp

      Filesize

      56KB

    • memory/4816-4-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4816-2-0x0000000000750000-0x0000000000751000-memory.dmp

      Filesize

      4KB

    • memory/4816-1-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB