Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

d5f2cdb781...18.exe

windows7-x64

7

d5f2cdb781...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    136s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 08:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d5f2cdb7815b33b499d5c8887cb5c0e2_JaffaCakes118.exe

  • Size

    32KB

  • MD5

    d5f2cdb7815b33b499d5c8887cb5c0e2

  • SHA1

    4851d244dc7789e4868d55e3c66e2205dbff6bcb

  • SHA256

    5652c655d7ceb0a87cf5ebfcb8932f9570f125691d9240431d8a31afb028db6e

  • SHA512

    f4fb730d8cce2dae5d1bd4789ffcce548e5de4e2619a37f968ef7f2efa95e66a87dc410c10ca46a9ab57adfad6e4f37357bac6e9bfa12cd33726a0f320d6c267

  • SSDEEP

    768:4RGo+gKZu+aOTI4kGVlgKYuISt14HHqvX9Sx2hnbcuyD7U:4j+hu+aYkKY8tSxknouy8

Score
7/10
discoveryexecutionupx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5f2cdb7815b33b499d5c8887cb5c0e2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d5f2cdb7815b33b499d5c8887cb5c0e2_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3360
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\DOwrfiIE.js" "C:\Users\Admin\AppData\Local\Temp\d5f2cdb7815b33b499d5c8887cb5c0e2_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3848
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4012,i,15336851255456239337,16379811035920490645,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
    1⤵
      PID:1212
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
      • System Location Discovery: System Language Discovery
      PID:4600
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3396 CREDAT:17410 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3984
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3396 CREDAT:82946 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3560

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BKKBWXOR\favicon[1].htm
      Filesize

      291B

      MD5

      b73189024a094989653a1002fb6a790b

      SHA1

      0c44f096cd1fec253c1fe2fcfcd3c58fe05c402d

      SHA256

      014c471c07b2bc1b90cf5b46eb8eb60abe3ac278e43cd8fcc7c4e6c8950c592d

      SHA512

      1bca726835d33847812060c968e5306535f513429de5c90d66942155fd42ff75508dba97da8ca36c6d6e6a8df5a2602fe3be047bb5612ad4e367c6c00e1e50a3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DOwrfiIE.js
      Filesize

      4KB

      MD5

      00c8f47f417bbfdd381870d4bc0fc3b4

      SHA1

      da21b3217953ca214587c7cf678a66b66634299f

      SHA256

      f3bfefd92bc2b2f67557e68ef1f9629724358796528996790baf8ccdf0230901

      SHA512

      25db0fb489fea9b1ea0ee09bf39610af29ce9dc9b9cc07f66ee78f66bcc15982926e163590a2e2fe398dcaebacd61b2ccd78dee306845044a3ce23285769f219

      Download Submit

    • memory/3360-0-0x0000000000010000-0x0000000000030000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3360-3-0x0000000000010000-0x0000000000030000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3360-4-0x0000000000010000-0x0000000000030000-memory.dmp

      Filesize

      128KB

      Download