Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13/09/2024, 01:51
General
-
Target
dd7123e014e067e0927b4189eaac4264_JaffaCakes118.exe
-
Size
172KB
-
MD5
dd7123e014e067e0927b4189eaac4264
-
SHA1
2ce7f04c3cec8aa926a282080081a1cb61781820
-
SHA256
b0a825d60cd77873437a57c2fb9a42aa2a7983eec27307e7242a1390fb9e48f5
-
SHA512
1bee2d19f060c3d1d116804e8c131752df129934a362a69f1a627dcf62b7790636beba1d7514deff40a89d58a93f9e2ebf5d42d1a42cf5628f28dd8145663332
-
SSDEEP
1536:23vhewkJj7tm2UgiNWh8mdKbN8RINnLGobNl8BP0p9jQx2cAiiDbB0snVHsIGoR8:4M7JX3XiFdlbNeQ9jUWiaFHcIkJpm
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
Masterdark1
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd7123e014e067e0927b4189eaac4264_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dd7123e014e067e0927b4189eaac4264_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-aiqmdsm.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD35.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3ABB66F94A2E46B78371C6295586812E.TMP"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\ひyбnhсC.exe"C:\Users\Admin\AppData\Local\Temp\ひyбnhсC.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5aa63eaa0e3f951e18aff653d2e387b79
SHA1df06ee9b9bad2a7765a6fb1ac86edcfc94e2e97f
SHA2566724b5f82d8c31ad8f2fb75a5561d80df0ff88abecb49fcdbff4c6be0e647229
SHA512fad912278340f23d6400480b2f734284f2d34321596bb5cdb4a4bc6b23c88847b9f2635fb2938b168c57034e0d57fa3e0ed0044c53b150dba3a050f364a5ed58
-
Filesize
240B
MD57f676f41a248b5919069847c8f9df814
SHA14ce18d1c754de3255a856d4b1bc47ee3956a5e5d
SHA2566c7f7143526c3ef8e80e32a60687403929db838a442f8e792dfdbb2023d4309c
SHA512aa547f559ee50bc337ab4ba624521e71c1faeaef55ec96ed7f740eb91bfdbc231c2426ab6950a473317268baa1fd753e401b6dbadf3ac9e84275fde923011d33
-
Filesize
1KB
MD5fec67d755a523f895506348008c9c5e4
SHA19e6da09da998a08e46ca81121b116e3df2687875
SHA2564b4dff8a92ce9543c7a381cbb84ecbc86c3d74636a1e6f1accba287e737cdfc8
SHA5121755ead2a5337f5dbdda12a76abef425f2383cf61dc68d905b10b9448f24e6427c6f380ea3098fea2c2464992eb023b3f731b8be06a9a49ff299f33b955bc8be
-
Filesize
644B
MD599391a82e5b561dfc9cc7ac81a1cb201
SHA10ba207b51bb89f646ad3d24983bd9494c5c97919
SHA256f65b6aab72948c9a1727295169c5f79527ab39d7dfd67e0493ab6d501739d8ee
SHA5127915df9d88875ad7d8fef7070626750d0aa00a2ed006b17d61c770ed44bfab4c29c13a79a29b8adf865b3fd9c94e2f748708c968d7c15e2aa48e187406908f2c
-
Filesize
7KB
MD5f2990907d878b119a9ce36abc39a7409
SHA1607dbd9c7cc36ae04c580c22c04bc6cdc9f6a611
SHA2568280aa3b15ea3beb037f6362d0fc5f908e089b398a965a7b93eac5f71785702d
SHA5129fa1e3e22c12163a72b93c00d21c2961edfbf28287b9d7b4957ee46d2d22abe558c003c0c679c66176c5f87c685d12dfa3b36eb55cd29a44b7fe9cb32231eb66
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB