Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

eeae49ada7...18.exe

windows7-x64

10

eeae49ada7...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2024, 23:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eeae49ada7ea91c10c6b3ad8c17efb23_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    eeae49ada7ea91c10c6b3ad8c17efb23

  • SHA1

    8dc8ca1ba225cc9a0bffea5ca78a63cf901f7f6d

  • SHA256

    37d85a211b7bbf2ede2fe15c557146b0fa2db301c053dfd3817534a8b677d9ab

  • SHA512

    b68e8c46428b39f38abad31bec82c82334d94c6329437542a7727ee2133573816db3cd80d897454bbe0118379e2d781ad7b994527dbf8858417cdb4909bd20a2

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 28 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 19 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eeae49ada7ea91c10c6b3ad8c17efb23_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eeae49ada7ea91c10c6b3ad8c17efb23_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\SysWOW64\haiypnhjhg.exe
      haiypnhjhg.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Windows\SysWOW64\vvcufoii.exe
        C:\Windows\system32\vvcufoii.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2704
    • C:\Windows\SysWOW64\pmjwyhcefzqoswr.exe
      pmjwyhcefzqoswr.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2060
    • C:\Windows\SysWOW64\vvcufoii.exe
      vvcufoii.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2068
    • C:\Windows\SysWOW64\wbimgjrxrgnte.exe
      wbimgjrxrgnte.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2484
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:316

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Privilege Escalation

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Defense Evasion

    Hide Artifacts

    2
    T1564

    Hidden Files and Directories

    2
    T1564.001

    Impair Defenses

    2
    T1562

    Disable or Modify Tools

    2
    T1562.001

    Modify Registry

    6
    T1112

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      f1012a0508b1c2758e93c6450bc34282

      SHA1

      9e3938a1fd451d9be1c4b816161c0ae3bebf3e83

      SHA256

      aec7e873a262eceaf58119d23c545c6d2ac0f148751ec017340b9c8e3468213e

      SHA512

      f3b011306a4dc802c317cf04208404e14fe2f2e419eadbd286b132d6ae31f3987278e762044bdb95ca98573149d25e8c1a962a2cc5d4453ed4bf7efb10712a2a

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      4091e90a442ee8c6a61305fec3a34199

      SHA1

      755b232b95f2b6f534c32de3c40f46101f01c990

      SHA256

      5cc82ba9adac78a72f0c6033a5dd75e35f6234df18dadbe962d91c2a77856c87

      SHA512

      70c9003d057087d19ca91a65c66997c9464778a42a76daf25f5c5ff7bdc166923f370d59063e030b716a2e6b4deac17ddd47d899718303d36ee1dc1cb0daffe5

      Download Submit

    • C:\Program Files\CompareHide.doc.exe
      Filesize

      512KB

      MD5

      6114544c1745c2eed7dd8157b42ba943

      SHA1

      b3bf94a1630aba51b72b0b45b12f750999836575

      SHA256

      635a08fb4073175f9fe9aae07100e3f82c1200f599f08f25295dce35d7346a4f

      SHA512

      4c2c9aa517ffe4e50003f96b452e965e7e5bbda227f03f48021fa56450cd1c914da3a87105ad568f9daec03460c2ed382e93798804e03ac3c1eeb22236d03b49

      Download Submit

    • C:\Program Files\ExitRequest.doc.exe
      Filesize

      512KB

      MD5

      e4a4f2ff877acdb6f4acb0bd1816bac6

      SHA1

      7354b41616b374295fd73a5b552b6e751e0ff15e

      SHA256

      63485641edd67d1ba96d82ae072c0988f2a5e697cc22eec34683e925a036c20c

      SHA512

      16853c16e8e2f8ad5047e1e965d39e1559a567ac41b23c147b8c3b890a8a1692d3437917eba400427cd7bd7663e5dae57092007f7f5414dc10547a427e8bd57e

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      19KB

      MD5

      c7db97155262a8cdf878f6c56f64df28

      SHA1

      d57cc96d5c1559f0facca2ccd75a83c0a13970d7

      SHA256

      e92bcbc6b76c1fa6cee875e2902966a84e6bf4880cd2ade9e5e16dcc68f6c974

      SHA512

      f3167460f54b644b0f57dfd1741bcc88ec2288717e9b032d2c4c8796feb4b5c03dfe2b09b87ac3a18f6a5ccd9686b6bb3293419ec6060ea1246ac13562eb01f2

      Download Submit

    • C:\Windows\SysWOW64\pmjwyhcefzqoswr.exe
      Filesize

      512KB

      MD5

      0594770392a6c228ffb26f20cc02b378

      SHA1

      55c16ec69e126f8e63a38366187e5020acb36815

      SHA256

      5ecee3883fe4514595a2b8a863bdef4ef9619ac0a4fc708cc1ab5522a01aac16

      SHA512

      d46826ccc2db807cdae64d7e2a93cee14c1ae46851ea596bad3b1715f7644c6a654fa5ac4d28fe3b34110aa453887c20ea0d31ec2c8727df66eeff89ed4f7ef9

      Download Submit

    • C:\Windows\SysWOW64\wbimgjrxrgnte.exe
      Filesize

      512KB

      MD5

      daa8dfa74ab53149e649c171c451ee6b

      SHA1

      8cf963cb20661ea01953d103814006036567f093

      SHA256

      9b9d4aec69425c0f14e42ec9631165ac137e72184aae66fff644a0492e343486

      SHA512

      18d098acc105732d79f0f2dcd74267e5bec51cbf00b2bff05d36f3b8fb16ed2f1e094b9d3da37d7278ecde30dbe962c50944e5035071b1f6a659590da6e76351

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\haiypnhjhg.exe
      Filesize

      512KB

      MD5

      56cb08f881060c14caee4ba3f110f430

      SHA1

      3a99320664ff6de914f59277d75d93da10e1e4ec

      SHA256

      c7bd36c8cb74092ba87b4cc1b39770e71f1bb765f1ffec493457a8921a83812f

      SHA512

      158fe7cd9276a4f32f3a6e88c0a668616babcbaa4caab54a5ac04a8c427d8c0b0bfcc055f3150e9fb5dfcecfe397c970126223270e305bd2abfb2fddc10e5cae

      Download Submit

    • \Windows\SysWOW64\vvcufoii.exe
      Filesize

      512KB

      MD5

      ba0f066e3202f4145fbf3fe47dc9aa94

      SHA1

      1c0e676586e038fff52af3977bb34e98dcb41527

      SHA256

      cace5276540498910a788bc77c7f7f9404fd402adabb158066feca96bf97ded8

      SHA512

      130eae0cd98049e19e28f561ddc562ea4174a2c858d5f035063537b933a4865a0a68583c8f1a06caa4a7e467c1a03e81b0d44dedea6287cc85892c4cbb1751ba

      Download Submit

    • memory/2248-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2300-42-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2300-106-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download