Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 21:17

General

  • Target

    deeae251b5e193279a157e2471d2405d_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    deeae251b5e193279a157e2471d2405d

  • SHA1

    e82f867eaebaf557d22f0dbbbcd5679695649b24

  • SHA256

    8a1cddad43d0a5117185250c05ab7cabb8617e2ff0d4994d1b2bfe0de374e615

  • SHA512

    6df4b0725568cb97872821f1699e721d4269834ca9fdb8e583c83bae309e9c8dd991ffd298811652c96de45a4c6926e14391a606c08a7a63058a11a16d33c664

  • SSDEEP

    24576:ByuFhCwUuqDluBMfEhJX3z5mKhwbLeoM1B:RhxqDosEL3F/w+3

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\deeae251b5e193279a157e2471d2405d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\deeae251b5e193279a157e2471d2405d_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\smes\u.bat"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\ProgramData\smes\smes.exe
        smes.exe -install
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3524
      • C:\ProgramData\smes\smes.exe
        smes.exe -start
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4544
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4156
  • C:\ProgramData\smes\smes.exe
    C:\ProgramData\smes\smes.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\ProgramData\smes\smes.exe
      C:\ProgramData\smes\smes.exe -run
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\kingsoft\kws\kws.ini

    Filesize

    718B

    MD5

    0318d2f94f0145e80c51bfbb3aed769d

    SHA1

    ba8ec32df73b8539eeca46f39e29a4e9af371ea1

    SHA256

    58ea7e766662ed6cd9274313db7824261e16246b2b0d232b973d8e76a1291e43

    SHA512

    00312951c03f6f0caf88d7ad0537c7b29c425d4b4ba08975f2d7a1ac222aa15611488b7fd7b31229aada46d4c0df4d68affe8bdbd860f7aadcaa03e39ead312b

  • C:\ProgramData\smes\KWSSVC.log

    Filesize

    202B

    MD5

    a25a030ccb136e4ded90ae6dae4021d0

    SHA1

    ddacfc795871ec7742e9aa6fbc505c5af67b3415

    SHA256

    8a7d4cff13347669f1b637c679d0784e7e00f2c802389cfd02f08b91a162f73e

    SHA512

    778614152a6853455874d7ae5302cdad5364eebf495e0abcd0e2f959e7326b0c7efc817fdc61507f7a5f1a1f84461c7ef155aabae5578a51b65cac3bb2000165

  • C:\ProgramData\smes\KWSSVC.log

    Filesize

    448B

    MD5

    5527fe9e39b70b342b47999b43859ada

    SHA1

    49a3d755cc296101a90d15851f6924e36c693609

    SHA256

    2edbff3dfce1dabb4fba3b3d64c4396b02928288da9f62ccfc4df214ecaef6d7

    SHA512

    2828b3e261b6d121ad7f6d88d98d17e9f523b6fbc2391ac5e2a2587ae30e3f73993e4d5696b5595b0207219649ce595124ee7efccba8d350c7c60d6b8c232ed8

  • C:\ProgramData\smes\KWSSVC.log

    Filesize

    546B

    MD5

    84401c6498ddee708c3cb36453fb89f1

    SHA1

    daa14771d2d1f8093bdf995d03dcfe25458efc39

    SHA256

    3fa44d0f4ce8a4efb65f390e825d22c86b4d14c03c025e26aa984289a94d8604

    SHA512

    6f280ffc59c57fa9af0532b9bd756d3233771e4d8d721572ba6629f9009db9ba33dd892b2b3410c8e244bdf722236d02c25296abfbeae342dc1377fc5cfcbe73

  • C:\ProgramData\smes\kswebshield.dll

    Filesize

    441KB

    MD5

    7851449473178f9782263d51bc5e3bbc

    SHA1

    ad5148ee1bed2348b320c62c025d52fbcbb28799

    SHA256

    c3bc7ec8428f0bb210a0597c9a0cad1be412b7fa46ea006819a3df9ac23118b4

    SHA512

    b01fc37ac84b81df8d7657000295aed7eb50aaf7f13ab2b2be9030c9f83ed1559318c83c78b4a29926d7d30e9eea9538d123ef4a649179be5a5b54ee71ed9b49

  • C:\ProgramData\smes\kwssp.dll

    Filesize

    425KB

    MD5

    bf5dcfd9da0514334d41cbd80d2a9138

    SHA1

    802f9e0b82edca56be08a33b2ba874b34c31f1e3

    SHA256

    f9506cf9a87aa6bfbf07f2124f2785a711b27a70839ebb95bdd4b2cf747fb060

    SHA512

    246796f2e201cde30043eaa2c0ffb4d2b3bea2bae97261a022824c31a42d2b08998b1bdcd436e8392bdd153dd6fadf9ba69361c7316a6bfda5d475678b7aa5cc

  • C:\ProgramData\smes\kwsui.dll

    Filesize

    433KB

    MD5

    45199dab51eeece95728abfe25e18f35

    SHA1

    59ab0fe25aa2adc253adbecba6862e7432df1c39

    SHA256

    a22006861cac6a849346282e2f7729deeb8f68bf29f13c15ae33d20311f77391

    SHA512

    825c6ae1f88cec3d6c469e6a15cad0430845ecc8d436777092f4c5fe8ecd02abbfeb3e2a17b2f4896b9d6e4b2d229a8b83bfdda75a3e025fc32f86610c6eef12

  • C:\ProgramData\smes\smes.exe

    Filesize

    209KB

    MD5

    1fa47f5b173cee5ef9c3ee1bda0c321e

    SHA1

    60ee40236f960affb01d569a32e1b05888bb081a

    SHA256

    b21526716068d2a8550780038e2b5ddb843d77890a07ec82ed9ce9dd0be52c64

    SHA512

    01f39376269a75510347fcf66ff2585b25d5e6e10e26b7feefa3af66e712a5f50c62bff6d40abee733e1ce965d17a2e443664838268eb7c7a2e36fc1c024224d

  • C:\ProgramData\smes\u.bat

    Filesize

    44B

    MD5

    704efba1aee1454561da552dda430498

    SHA1

    d20fb96683f769eb9cef1b0a068bcba70aeab9c2

    SHA256

    80b08d35bd27636e0774ce35ab57306f76edc6a0f7058cb1f93733cdf88bf94c

    SHA512

    7e0c9ede686238703af4893af8842c05c48ab1681ae273b32d8085cf1a17aae946c0c823a0a418787522a551d684367259ff8203ebca6e4ec69b6ded95231bd0

  • C:\Users\Admin\AppData\Local\Temp\nsl87EE.tmp\AccessControl.dll

    Filesize

    10KB

    MD5

    055f4f9260e07fc83f71877cbb7f4fad

    SHA1

    a245131af1a182de99bd74af9ff1fab17977a72f

    SHA256

    4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc

    SHA512

    a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26

  • C:\Users\Admin\AppData\Local\Temp\nsl87EE.tmp\FindProcDLL.dll

    Filesize

    3KB

    MD5

    8614c450637267afacad1645e23ba24a

    SHA1

    e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    SHA256

    0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    SHA512

    af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

  • C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat

    Filesize

    135B

    MD5

    762bee8a4e5f95038202c7db88ab7626

    SHA1

    66a7bdd3868b9e3372ef5d5cbb06be794baa0830

    SHA256

    2e81f3b42d86549e770d913b4eb9c6c6faa7b1562cbf55caa474f781b7f124cf

    SHA512

    872063da251c800e848f7f2fe302c027f0b6e179db677a7d8dfef526130514c3153237c5e74ebaf50d21a286d5a73c4ddcfcbc2435e5024bfb71c3ca66293b5e

  • memory/1448-49-0x00000000020A0000-0x0000000002111000-memory.dmp

    Filesize

    452KB

  • memory/1680-3-0x0000000010000000-0x0000000010003000-memory.dmp

    Filesize

    12KB