Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09/09/2024, 17:03
General
-
Target
d6c086bd2cb9f0bad442d057fb922d76_JaffaCakes118.msi
-
Size
1012KB
-
MD5
d6c086bd2cb9f0bad442d057fb922d76
-
SHA1
c6d62de15313918968ca2de3cd4233d2177fa848
-
SHA256
753aad9e9c12de41f51b1316c4aa6b50c3f359f12b09a72ece99bd6cce2e6537
-
SHA512
869757a0bd7852656c0694564dc21cd577a90b6cfa1c67bad3db61288bd951b55969e62b24f7e0ddad516bf98c7b046b20a95535a637650d9cef0b8b03faac9b
-
SSDEEP
12288:hEt8ZPcBLP41FUCtmHlgDvq7BOTszKS6mCZ0e8kcJ+:hEt8a5gbUFHA0By0e5cJ+
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 8 IoCs
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 57 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d6c086bd2cb9f0bad442d057fb922d76_JaffaCakes118.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Installer\MSIF4D1.tmp"C:\Windows\Installer\MSIF4D1.tmp"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SekcVGmvsmWO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC520.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Installer\MSIF4D1.tmp"C:\Windows\Installer\MSIF4D1.tmp"3⤵
- Accesses Microsoft Outlook profiles
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
663B
MD5d54bf977078df21b48910539ad17e21b
SHA1dce01852d2ddaadb84fc0d15b905156256d5f574
SHA256ff475a459b6be42242c1d15b4f36b88b0e7ab4d0f1db1a26a519ec7cff355e30
SHA512b54c62df5cd9f7202fc0017de8fd9ebbd06b4f82764198ae27acba5021d4604dcd3cb03ce691e63b6ff12dd68af9b61050a69fa128e94eb6f940c957479e189c
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
1KB
MD5180aee515447773678c9fe5746f683a9
SHA11866443f1bd5b018665c5af83e7a8c1593d15563
SHA256dea0f2c1a6c06b39e7af9fa7212f32bb680dd2c77cd1a67b6416a9e7fe622163
SHA512c4242fb09b3cc4aaf0433d4b86c5a2ef64108ef35a323e2af35126c35fe0bcf99890d187889f3323f2db6fb3a5fe6ac4517356224684da8623b988267cea3cf9
-
Filesize
984KB
MD50575ec33b5638907ac7cc23c0775f2c6
SHA16797cf3cd0035c5ba16ea24a93203c89ee5b70b0
SHA256b7ea1c16cfa57e9787464e48363ff5d004df399cecc75f234e8145191742fd6f
SHA51210873b91906a32ee65b04eebf80a503070c489ba9d563db5e39a2df202c9ae18b64e2717a3082e780f6d937747fb63e749596e41f192bc5a979c0523f24bd3fa
-
Filesize
23.7MB
MD594784e22f49ea3945b7439d8f11f9eeb
SHA1b419fec0f1fb2b64c743e703b2394ee99af68aeb
SHA2564290f6fae694a99e82d42572f4526e65c5c83714850437f11f5d7c406a9c2e75
SHA51292ee46750f893cea5bcbf7eba9a554b9762e6a69353810567b5414e0bfadf4a1712e1f22cff0e150fa32ad41db86f259db79005f4dafe33ad537448590b705e0
-
Filesize
6KB
MD5f828a19e9bb8a4f0611e865a3940cb1a
SHA1555d9aa9197fb1d3602ac4e6fa0c376c3bd5471e
SHA25697964a27c04e6b93ccee0a3522aa6e8ff9c946f53f6f066c5b611d9f58519a1a
SHA5128e952fcb438e8c091d4982a304faffd0883f40079539452f711f70832fa9af3eb8df4f6d67c2ebd14b8572e29bd138d2ff899ebf6b6ff891b4e92f69d9e48a70
-
Filesize
320KB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
96KB
-
Filesize
360KB
-
Filesize
5.6MB
-
Filesize
40KB
-
Filesize
464KB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
1008KB