Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/09/2024, 21:17

General

  • Target

    deeae251b5e193279a157e2471d2405d_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    deeae251b5e193279a157e2471d2405d

  • SHA1

    e82f867eaebaf557d22f0dbbbcd5679695649b24

  • SHA256

    8a1cddad43d0a5117185250c05ab7cabb8617e2ff0d4994d1b2bfe0de374e615

  • SHA512

    6df4b0725568cb97872821f1699e721d4269834ca9fdb8e583c83bae309e9c8dd991ffd298811652c96de45a4c6926e14391a606c08a7a63058a11a16d33c664

  • SSDEEP

    24576:ByuFhCwUuqDluBMfEhJX3z5mKhwbLeoM1B:RhxqDosEL3F/w+3

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\deeae251b5e193279a157e2471d2405d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\deeae251b5e193279a157e2471d2405d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\smes\u.bat"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\ProgramData\smes\smes.exe
        smes.exe -install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2592
      • C:\ProgramData\smes\smes.exe
        smes.exe -start
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2720
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2800
  • C:\ProgramData\smes\smes.exe
    C:\ProgramData\smes\smes.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\ProgramData\smes\smes.exe
      C:\ProgramData\smes\smes.exe -run
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\kingsoft\kws\kws.ini

    Filesize

    718B

    MD5

    0318d2f94f0145e80c51bfbb3aed769d

    SHA1

    ba8ec32df73b8539eeca46f39e29a4e9af371ea1

    SHA256

    58ea7e766662ed6cd9274313db7824261e16246b2b0d232b973d8e76a1291e43

    SHA512

    00312951c03f6f0caf88d7ad0537c7b29c425d4b4ba08975f2d7a1ac222aa15611488b7fd7b31229aada46d4c0df4d68affe8bdbd860f7aadcaa03e39ead312b

  • C:\ProgramData\smes\KWSSVC.log

    Filesize

    202B

    MD5

    ef46a35e90bc3599842ef60e136345ef

    SHA1

    21e6a175c0687554b2b4fcc90b59529fbe3901e3

    SHA256

    1a16c16b0e5ae867a8aca1d7b07627a5de1381165c259a9bc198b734363ea1e0

    SHA512

    a5b8516bf620b1c9f28244bd3f3d0fa38c1d67c9d5d9f4a22460d1a63c43a477ad7698d6215c06a4c141b6515c5a168a4a8baf755d865e3c6288434165b6a008

  • C:\ProgramData\smes\KWSSVC.log

    Filesize

    448B

    MD5

    56acd9e4034c38643f17308b60cbdfe7

    SHA1

    8d15ed4e1aed244b7ebd20d1ad5083e5ae89f3e8

    SHA256

    de591c008da3c4c7cf6b42d13f4bde7b5036e5606df0df492df0eb3c9c6f3491

    SHA512

    cb6984e2648b719c2a73136edc7da284b6b300ff02cc7f955190913f0dc36d1127907bdb2d1dee25123587686552d607b872f47ab63dc7d3456fdf4b489e0d09

  • C:\ProgramData\smes\KWSSVC.log

    Filesize

    546B

    MD5

    97270319ebb581807adc5d2982001dbc

    SHA1

    d91bb3abb26b207851a3fe1a49cccd657686e2e7

    SHA256

    0b707c00b2cd1cd25f1d6b419e818742a87f43d47b480fc69c0d6c626192952a

    SHA512

    7160f2eef5c95c507566e62f7960f5af3d45a9f4c0ac09acd95827c4df7effea9dad2c1be85e1dca49623fddabc6f10efcd33a32734059d6b3abc004babd5532

  • C:\ProgramData\smes\kswebshield.dll

    Filesize

    441KB

    MD5

    7851449473178f9782263d51bc5e3bbc

    SHA1

    ad5148ee1bed2348b320c62c025d52fbcbb28799

    SHA256

    c3bc7ec8428f0bb210a0597c9a0cad1be412b7fa46ea006819a3df9ac23118b4

    SHA512

    b01fc37ac84b81df8d7657000295aed7eb50aaf7f13ab2b2be9030c9f83ed1559318c83c78b4a29926d7d30e9eea9538d123ef4a649179be5a5b54ee71ed9b49

  • C:\ProgramData\smes\kwssp.dll

    Filesize

    425KB

    MD5

    bf5dcfd9da0514334d41cbd80d2a9138

    SHA1

    802f9e0b82edca56be08a33b2ba874b34c31f1e3

    SHA256

    f9506cf9a87aa6bfbf07f2124f2785a711b27a70839ebb95bdd4b2cf747fb060

    SHA512

    246796f2e201cde30043eaa2c0ffb4d2b3bea2bae97261a022824c31a42d2b08998b1bdcd436e8392bdd153dd6fadf9ba69361c7316a6bfda5d475678b7aa5cc

  • C:\ProgramData\smes\kwsui.dll

    Filesize

    433KB

    MD5

    45199dab51eeece95728abfe25e18f35

    SHA1

    59ab0fe25aa2adc253adbecba6862e7432df1c39

    SHA256

    a22006861cac6a849346282e2f7729deeb8f68bf29f13c15ae33d20311f77391

    SHA512

    825c6ae1f88cec3d6c469e6a15cad0430845ecc8d436777092f4c5fe8ecd02abbfeb3e2a17b2f4896b9d6e4b2d229a8b83bfdda75a3e025fc32f86610c6eef12

  • C:\ProgramData\smes\u.bat

    Filesize

    44B

    MD5

    704efba1aee1454561da552dda430498

    SHA1

    d20fb96683f769eb9cef1b0a068bcba70aeab9c2

    SHA256

    80b08d35bd27636e0774ce35ab57306f76edc6a0f7058cb1f93733cdf88bf94c

    SHA512

    7e0c9ede686238703af4893af8842c05c48ab1681ae273b32d8085cf1a17aae946c0c823a0a418787522a551d684367259ff8203ebca6e4ec69b6ded95231bd0

  • C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat

    Filesize

    135B

    MD5

    762bee8a4e5f95038202c7db88ab7626

    SHA1

    66a7bdd3868b9e3372ef5d5cbb06be794baa0830

    SHA256

    2e81f3b42d86549e770d913b4eb9c6c6faa7b1562cbf55caa474f781b7f124cf

    SHA512

    872063da251c800e848f7f2fe302c027f0b6e179db677a7d8dfef526130514c3153237c5e74ebaf50d21a286d5a73c4ddcfcbc2435e5024bfb71c3ca66293b5e

  • \ProgramData\smes\smes.exe

    Filesize

    209KB

    MD5

    1fa47f5b173cee5ef9c3ee1bda0c321e

    SHA1

    60ee40236f960affb01d569a32e1b05888bb081a

    SHA256

    b21526716068d2a8550780038e2b5ddb843d77890a07ec82ed9ce9dd0be52c64

    SHA512

    01f39376269a75510347fcf66ff2585b25d5e6e10e26b7feefa3af66e712a5f50c62bff6d40abee733e1ce965d17a2e443664838268eb7c7a2e36fc1c024224d

  • \Users\Admin\AppData\Local\Temp\nst931C.tmp\AccessControl.dll

    Filesize

    10KB

    MD5

    055f4f9260e07fc83f71877cbb7f4fad

    SHA1

    a245131af1a182de99bd74af9ff1fab17977a72f

    SHA256

    4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc

    SHA512

    a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26

  • \Users\Admin\AppData\Local\Temp\nst931C.tmp\FindProcDLL.dll

    Filesize

    3KB

    MD5

    8614c450637267afacad1645e23ba24a

    SHA1

    e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    SHA256

    0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    SHA512

    af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

  • memory/2980-56-0x0000000001B90000-0x0000000001C01000-memory.dmp

    Filesize

    452KB

  • memory/3020-5-0x0000000010000000-0x0000000010003000-memory.dmp

    Filesize

    12KB