Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 06:02

General

  • Target

    eab8a85c6a4a4ae2d57413b6a908c5c6_JaffaCakes118.exe

  • Size

    123KB

  • MD5

    eab8a85c6a4a4ae2d57413b6a908c5c6

  • SHA1

    03cceb721c67d09fae5d39a111da10c73a961b9a

  • SHA256

    609e570f84417499bee21be1c40cfcfaf683330c3df7a0f0c12355f242c21ff8

  • SHA512

    215b293b4fa2cadb6aca5f3ae3aa3706e8203a3a892219db5f7ae68de9bd7a30abbfe18b9626a070c5916c3c9aa28455ba55176c93f288c4d63803ba1d5d0339

  • SSDEEP

    3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLLJBRo:OVYrJrOSsRwcppRo

Score
8/10

Malware Config

Signatures

  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 4 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eab8a85c6a4a4ae2d57413b6a908c5c6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eab8a85c6a4a4ae2d57413b6a908c5c6_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:732
    • C:\Windows\iaccess32.exe
      C:\Windows\iaccess32.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Windows\SysWOW64\regedit.exe
        "C:\Windows\System32\regedit.exe" /s C:\Windows\tmlpcert2007
        3⤵
        • Manipulates Digital Signatures
        • System Location Discovery: System Language Discovery
        • Runs regedit.exe
        PID:628
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Windows\system32\egaccess4_1071.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3028
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1076

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Instant Access\DesktopIcons\NOCREDITCARD.lnk

      Filesize

      2KB

      MD5

      218e31d763fadf719ed383c9452e013d

      SHA1

      a4b29abc451052511bf80476e2fa258620e2861e

      SHA256

      34df5a3d04bf447a1b5c930c13a11aec99db13c3ccfa3cd61b16590ae1e985b5

      SHA512

      5d586ae5c48a8060203e5909870c341092b23c601829de9f1c4c43d10dd6a79e0f6d41975a140b77cb6e08238fe83e4f32dade6b9b765ddb30c11ca3a9474193

    • C:\Windows\SysWOW64\egaccess4_1071.dll

      Filesize

      76KB

      MD5

      b83f652ffa76451ae438954f89c02f62

      SHA1

      b3ba0014dd16cee5f6d4cfe7e28b2d5de79dc6dd

      SHA256

      f601991aa00cbe7001197affc0e3854ab76c51c05b9a6ca3e3f708fed876c32f

      SHA512

      965172a5ecd070ea6707ec9985ee3c135c06534561b90ae233e8049b247d87d529b8280f0faf2b0ed933f59c68844414726fa80c4d3119cffa4fdd1cb60eab83

    • C:\Windows\dialerexe.ini

      Filesize

      587B

      MD5

      305993ee28d130645ea1ef894a784f91

      SHA1

      ebf5c7dd199b27ddb63a167ec18afa7448895c1a

      SHA256

      315baf92a149669a4435f5a73bb99c88aaf2838269111f0f437a97f944daa9cc

      SHA512

      b4aa4d2101924f2a372715d3a81e07919c27c7c143e212347b4fd184a471150d10770183903e30134162fe8bc72f3c2d1a46cb6ad24171c3300f97e03f657ffd

    • C:\Windows\iaccess32.exe

      Filesize

      123KB

      MD5

      f5c53b6ea40a82923768afbe6367cec5

      SHA1

      c75c7e7d46b03b187316ffb7756c77565d072ab9

      SHA256

      b9a5c5dadcc79feee85d639dc2f6e28aaf925f54d74e58d4c464f8835cace60a

      SHA512

      8d5db86e4bc9d33fec631094f0dc6fee3cdc0ce839f62883265aabeb3d3ef107e4794be4b2d4df4fcf27861c242e793b229ea94b6b92e28b30ad3e3e017d3434

    • C:\Windows\tmlpcert2007

      Filesize

      6KB

      MD5

      b103757bc3c714123b5efa26ff96a915

      SHA1

      991d6694c71736b59b9486339be44ae5e2b66fef

      SHA256

      eef8937445f24c2bcbe101419be42694e0e38628653a755ab29ecba357d81d48

      SHA512

      d04f2ab14ad4d3e06ea357b4c810515d73b32f2650533a5895ebf5d14b4b697752f25c0c371372e00faab661c0b051c33b8c25bf1226f30be5d6b8727dea81e1

    • memory/732-0-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/732-7-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1356-4-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1356-57-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/3028-29-0x0000000010000000-0x0000000010047000-memory.dmp

      Filesize

      284KB