Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 07:03

General

  • Target

    ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe

  • Size

    58KB

  • MD5

    ddea291496e6fe6bb2739c666ea1876f

  • SHA1

    47e323dd16280e1ade512094c82ef33210342475

  • SHA256

    44244177bebc0306e23721806059a64989be421960744c800693c99cb02b82c5

  • SHA512

    c4895a63a80f642a4cc6ca164ed755d6a77f55db29502959ff89a2170e36faafc12b2f8bef4516b9e16197aeea739dcb18ceca00a7a2d66383604dfb6e269338

  • SSDEEP

    768:MdICxZk/89MpVT7woQJcW/bnqC03T/yEwSndA/zJmnPi3Jnj:MTYd5QJc/vaSybs4

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

  • Discovers systems in the same network 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4036
    • C:\ProgramData\Application Data\wmimgmt.exe
      "C:\ProgramData\Application Data\wmimgmt.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4172
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /v:on /c C:\Users\Admin\AppData\Local\Temp\ghi.bat
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3568
        • C:\Windows\SysWOW64\findstr.exe
          findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1736
        • C:\Windows\SysWOW64\chcp.com
          chcp
          4⤵
          • System Location Discovery: System Language Discovery
          PID:740
        • C:\Windows\SysWOW64\net.exe
          net user
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1408
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user
            5⤵
            • System Location Discovery: System Language Discovery
            PID:876
        • C:\Windows\SysWOW64\net.exe
          net localgroup administrators
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4960
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 localgroup administrators
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4760
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1104
        • C:\Windows\SysWOW64\systeminfo.exe
          systeminfo
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers system information
          PID:1716
        • C:\Windows\SysWOW64\reg.exe
          reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2156
        • C:\Windows\SysWOW64\find.exe
          find "REG_"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1868
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4280
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3596
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:936
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5036
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4028
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3556
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1532
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /all
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers network information
          PID:4980
        • C:\Windows\SysWOW64\NETSTAT.EXE
          netstat -ano
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Connections Discovery
          • Gathers network information
          • Suspicious use of AdjustPrivilegeToken
          PID:2824
        • C:\Windows\SysWOW64\ARP.EXE
          arp -a
          4⤵
          • Network Service Discovery
          • System Location Discovery: System Language Discovery
          PID:3428
        • C:\Windows\SysWOW64\NETSTAT.EXE
          netstat -r
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers network information
          PID:3140
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4596
            • C:\Windows\SysWOW64\ROUTE.EXE
              C:\Windows\system32\route.exe print
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1268
        • C:\Windows\SysWOW64\net.exe
          net start
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3948
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start
            5⤵
            • System Location Discovery: System Language Discovery
            PID:760
        • C:\Windows\SysWOW64\net.exe
          net use
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3264
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo n"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4356
        • C:\Windows\SysWOW64\net.exe
          net share
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4812
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 share
            5⤵
            • System Location Discovery: System Language Discovery
            PID:452
        • C:\Windows\SysWOW64\net.exe
          net view /domain
          4⤵
          • System Location Discovery: System Language Discovery
          • Discovers systems in the same network
          PID:2232
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1512
        • C:\Windows\SysWOW64\find.exe
          find /i /v "------"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4056
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4080
        • C:\Windows\SysWOW64\find.exe
          find /i /v "domain"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2404
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2516
        • C:\Windows\SysWOW64\find.exe
          find /i /v "¬A╛╣"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3680
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4004
        • C:\Windows\SysWOW64\find.exe
          find /i /v "░⌡ªµª¿"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1464
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3548
        • C:\Windows\SysWOW64\find.exe
          find /i /v "├ⁿ┴ε"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5100
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5048
        • C:\Windows\SysWOW64\find.exe
          find /i /v "completed successfully"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\wmimgmt.exe

    Filesize

    58KB

    MD5

    ddea291496e6fe6bb2739c666ea1876f

    SHA1

    47e323dd16280e1ade512094c82ef33210342475

    SHA256

    44244177bebc0306e23721806059a64989be421960744c800693c99cb02b82c5

    SHA512

    c4895a63a80f642a4cc6ca164ed755d6a77f55db29502959ff89a2170e36faafc12b2f8bef4516b9e16197aeea739dcb18ceca00a7a2d66383604dfb6e269338

  • C:\Users\Admin\AppData\Local\Temp\INFO.TXT

    Filesize

    43B

    MD5

    9f6b9a6e9ceeb82c1b7f4542328d764a

    SHA1

    8f1b3a6cf28b9a8dc9eeff98e065b9b467d4d846

    SHA256

    5d3ae9823ebee16a6508452c045dcfeda36bbdc17c52439ada72afb5396ff793

    SHA512

    a0e6985b5e9fcad2197ffa232bc97ed4c00759793aa94490eb33ff68fba511d4e89e3e18bfc31604e5cd01cce1e71e806ae8ac34ce794d49727de551fa5180d7

  • C:\Users\Admin\AppData\Local\Temp\INFO.TXT

    Filesize

    12KB

    MD5

    c81c2ce00a81492acec3303258893c60

    SHA1

    389dd2fedc2af6c70573e015f7cf539a137c95fe

    SHA256

    ebeda5bd003643e00cbba317c4951b53525655b2f5fce10757791e6e4e6443a0

    SHA512

    d210fd604647dc077765d913407799ecf6d2484b41a3a526fa5222e90d4ff81b94233aff765000ca2568bc74b7e91238555c70df52ea70d8cab1e809e9efd657

  • C:\Users\Admin\AppData\Local\Temp\INFO.TXT

    Filesize

    21KB

    MD5

    9301cf23f61c4f945abb08858daa60e7

    SHA1

    1e81d87fca539edb9f9ce75a2c7436cfa9e34fb7

    SHA256

    0a43e2af23753f99f7d006f15915109b8f3a03e6467b938c6fafb7155d3e2795

    SHA512

    03ba617add76b9ff38290d04709132df64be07b53f4a99bf3063fd7564b039fd45e20cfe5edec47d5597021fd96f36333dd0ae51d38c208e46ccde85cf4de037

  • C:\Users\Admin\AppData\Local\Temp\INFO.TXT

    Filesize

    37.5MB

    MD5

    87e45b6c0eb20e3f829df7a7fe0506db

    SHA1

    46d5f39f77872ecb944e90fd6706152d6b015c5d

    SHA256

    af77fdf1d4e54f32d12e3f9e0902b6c0ef1f017a5ace713db090e32cc65b9f5a

    SHA512

    f8fd42f6f0fe713cc6110bf463b3549be9440bb8478e1f60a211806250bc315f3904fee7cd5e778a1f85f4bd5c93b675260020cf1e3070567c70fde7eeb5804a

  • C:\Users\Admin\AppData\Local\Temp\drivers.p

    Filesize

    15B

    MD5

    4ff8e80638f36abd8fb131c19425317b

    SHA1

    358665afaf5f88dfebcdb7c56e963693c520c136

    SHA256

    6b8ceb900443f4924efd3187693038965ad7edb488879305489aa72d78f69626

    SHA512

    d4e6e3d789bc76102c500b46a5aa799c5ebfc432a44117aa0b7c7512439d33a423630b963fb04cda1da17a7f6517b276a3e9298c17cbf795964090f4b9e5d8f1

  • C:\Users\Admin\AppData\Local\Temp\ghi.bat

    Filesize

    3KB

    MD5

    b98e8fcde49a1caee295a6bd3d264e56

    SHA1

    71c82391a8617212ad48c8d79755e71be2e20be9

    SHA256

    e369c7e2e7ac0280882693038b213be0309c910df62f35a5159a125ecd18fb9a

    SHA512

    fb5fa414449e7dd4ce1fedcb92487f59ed18d7fbd3146eb59ec8f7256d68551adebb7d35e859fe7b6bce5a0b042b0de1e9ee56369a8686976dd121b44ff46742

  • memory/4036-0-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/4036-7-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/4172-30-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB