Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

eebb481360...18.exe

windows7-x64

10

eebb481360...18.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 00:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eebb4813600a92e8c2ce7b55a90ad885_JaffaCakes118.exe

  • Size

    524KB

  • MD5

    eebb4813600a92e8c2ce7b55a90ad885

  • SHA1

    8f3ae9a52cd9ca728205b029d5f2c4cd7a7fd99d

  • SHA256

    b5277d03212e490e2cdc4d76fb285488f7aaec2e77c3eb6fcda5ad2b04085f91

  • SHA512

    fe5a7a117632ef7ef5dec5046963d49944b8effa3752c397107dce818477a5ade8a18a930e89d4c3cd46825143e18c65e74a748e265ab0697945670da2aacb7b

  • SSDEEP

    12288:eSFMFpuhRp8tmnkX4C4IosE/rSkU19Zt/kMM22:pF+u+gkX3o1jSkErM2

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 10 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 50 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    PID:332
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\eebb4813600a92e8c2ce7b55a90ad885_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\eebb4813600a92e8c2ce7b55a90ad885_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Users\Admin\JB3O2vP3.exe
        C:\Users\Admin\JB3O2vP3.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:372
        • C:\Users\Admin\juiofu.exe
          "C:\Users\Admin\juiofu.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2808
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del JB3O2vP3.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2712
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2752
      • C:\Users\Admin\2sun.exe
        C:\Users\Admin\2sun.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2484
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2464
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:612
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2608
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1920
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          PID:980
      • C:\Users\Admin\3sun.exe
        C:\Users\Admin\3sun.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2232
        • C:\Users\Admin\AppData\Local\d2f57668\X
          *0*bc*b3a99052*31.193.3.240:53
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1668
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1744
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del eebb4813600a92e8c2ce7b55a90ad885_JaffaCakes118.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:572
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\JB3O2vP3.exe
    Filesize

    228KB

    MD5

    290d691efc05b13247d2f6d8952a215b

    SHA1

    a885524eae321c2d025dd8e2fe4c8dd76dfb0ca0

    SHA256

    43b951fb64328c15a0592d228e90f05be14b4f18a902c35b5c0451020e1d82be

    SHA512

    8dfdcdd93b47db1b490a80fd1c483e5f10d18d782f34562bf7313039040c69878fb1d6ad22f1b3d6e48dcc8db507c430f11b1a976b48f9cd1769400fba4c150e

    Download Submit

  • C:\Windows\system32\consrv.dll
    Filesize

    29KB

    MD5

    1149c1bd71248a9d170e4568fb08df30

    SHA1

    6f77f183d65709901f476c5d6eebaed060a495f9

    SHA256

    c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

    SHA512

    9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

    Download Submit

  • \Users\Admin\2sun.exe
    Filesize

    128KB

    MD5

    cba16c1a489b02c4ff5720c68f35f787

    SHA1

    bd3d817f02e1492d246c067a6ddf3e0ec33d86c3

    SHA256

    0235b18287b0a3833cb877713019c2679a7699b2c848b16bfdf50244f8556e80

    SHA512

    00740a1e2bd2bba0f4f2486914fe1c885064d5dc6389561697e357a354e8cdc6707f4bd542c02179020ef69c6d9f1d3503eaf0111bb9c1eba1a64a194cb9c345

    Download Submit

  • \Users\Admin\3sun.exe
    Filesize

    278KB

    MD5

    345cbbd3a56a313f804b997f8cbecb2b

    SHA1

    9978d6f5bca8ab1486573ff073661e7cfd40c365

    SHA256

    492c8cf86fcfa07fcf5716b17593a9ec265c5aa919c2fe563a34ece1580b055c

    SHA512

    5cdb8b00ab0d653a34b3d1b2871ebeb0badfe223779dce775adf00d577a2931f77c1e6d92cda719e32a8683f6f729179f128472efdf6ec0ac18cbdbcfbbc237d

    Download Submit

  • \Users\Admin\AppData\Local\d2f57668\X
    Filesize

    38KB

    MD5

    72de2dadaf875e2fd7614e100419033c

    SHA1

    5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

    SHA256

    c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

    SHA512

    e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

    Download Submit

  • \Users\Admin\juiofu.exe
    Filesize

    228KB

    MD5

    c5f7f2c62bd8e57d513aa4792ef168b0

    SHA1

    8a93ee69809d1794bd1d38177ce6cd9eeb78fd49

    SHA256

    6fd70cecc751f9ee03c1a51aa194081fedb737b8e43937f29f4e5c496baa0bb0

    SHA512

    8864474f7a3abc0b4a01cc41ac00e76bfd778c935bba1f924c4cb8fc2f40ef74b793c1ea2eefb2bd011395ed9a4100d23c831f099489a8769b02d78cf5157380

    Download Submit

  • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
    Filesize

    2KB

    MD5

    a6fb3c7ae7e2fdf8000eee97bb2d2411

    SHA1

    40bf52c55bc655e48a2337cf642bbac28e3cec8d

    SHA256

    10b1e83c2a5b056eff6aa1163711f7ad440c453d91d0c6f446121b257d43f647

    SHA512

    6cb494b437d561f24f9c8d84b72f8ce882f5f5418bd086c0a6dbf758d002788f4f227c7e7903e108008200be2edb6c4f6b1c508076d8d0bbb2cef21922cff868

    Download Submit

  • memory/332-126-0x0000000000E60000-0x0000000000E6B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/372-27-0x0000000003830000-0x00000000042EA000-memory.dmp

    Filesize

    10.7MB

    Download

  • memory/612-55-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/612-50-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/612-52-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/612-65-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/612-68-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/612-48-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/612-71-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1192-131-0x00000000030A0000-0x00000000030AB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1192-113-0x0000000002E00000-0x0000000002E06000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1192-109-0x0000000002E00000-0x0000000002E06000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1192-105-0x0000000002E00000-0x0000000002E06000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1192-127-0x00000000030A0000-0x00000000030AB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1920-88-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/1920-84-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/1920-82-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/1920-78-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/1920-76-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/1920-85-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/2464-57-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/2464-56-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/2464-43-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/2464-46-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/2464-41-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/2464-103-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/2464-39-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/2464-70-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/2464-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2608-63-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/2608-59-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/2608-61-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/2608-92-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/2608-91-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/2608-139-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/2608-73-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download