Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

eedcd7fa05...18.exe

windows7-x64

10

eedcd7fa05...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 02:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eedcd7fa05e3566bbd509fd5d4c919de_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    eedcd7fa05e3566bbd509fd5d4c919de

  • SHA1

    4f8437a567232a7afaf07bbb052c58574848e0ef

  • SHA256

    5f8e2c60f6aaea359c884d4f0f33f57daebd7fe68d3804c3c88dd9d44e6d0825

  • SHA512

    66b333fc7f816b289178756fc8e07f0587565cb2c8e6158d8f80a620b302aabcb6966ed4cf9684c5abbe5982441388523b7014defad30dd2b8976c57892becac

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5B

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eedcd7fa05e3566bbd509fd5d4c919de_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eedcd7fa05e3566bbd509fd5d4c919de_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Windows\SysWOW64\xuduyanftz.exe
      xuduyanftz.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1876
      • C:\Windows\SysWOW64\mxylpsyu.exe
        C:\Windows\system32\mxylpsyu.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2968
    • C:\Windows\SysWOW64\ovrkejbphqeuhfp.exe
      ovrkejbphqeuhfp.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2504
    • C:\Windows\SysWOW64\mxylpsyu.exe
      mxylpsyu.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3800
    • C:\Windows\SysWOW64\ctcunyxxajksr.exe
      ctcunyxxajksr.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:264
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

6
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    81bbcd1fb91a59fde47efc1e36b1e249

    SHA1

    4ca133b40afbbe3e250e14dcf807253277e9d9a4

    SHA256

    77cb6bc5f6b20309512125c135f2be9616839e93394551bc48d179c1503a4a72

    SHA512

    01290d9a4c4cece28478be331dade3b33e765dfd54c3bf7394b4d1043f512d0fc56d6e7feb1533f48e634536ce718160b8e9bc58406934bc0dee2b512683b03b

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    dba694c7c55f76eee810c440801e22d2

    SHA1

    37df7b94f535eb4e98eedaaa4c50b417fa78a53c

    SHA256

    3bca9ee841802c7230bcedfb8635021905cf0c5d5feaed5f7fbc334fbc882ac5

    SHA512

    f33d735a09e595bdfddd3345a0dddb3969088afd9b6adb2211513512ca560e729abdbe51e9ffb29be0d536dc2039035801e7b511af6eaf462d23364ef5abfc00

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCDC5D7.tmp\sist02.xsl
    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    346B

    MD5

    e4af9c4729615d5d38f65bc89b94cf29

    SHA1

    684232048c63b6f9deb15a957173445213e27cc1

    SHA256

    6a848c0c81f06203aa89f0529ece172c81d946ae4857e7fabd36f313f0a37940

    SHA512

    75284333308d76edf6722cd6dabc36c41e7805d56b08045260a2392f122b58546c7bf4d7b2ab42e13e994cbe500633b4229617097cb1a02d3eb9252e6cfe1284

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    1KB

    MD5

    51294bf11db422596e921e06ef682265

    SHA1

    303632ae4f206c5bc8a41d368d9d6d3109e89bf0

    SHA256

    1c6c797145423929c031d2c1af3c41dedce688115343446d726d364a833338c8

    SHA512

    fd5a5e643e19ee5745a58ae2089d2200aa3cfd8d7b4ef8485902366814ec7d900bc71f55ba1a8d0a03ad940215f84edca07cf644cb1a541b37777699078a63fd

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    2KB

    MD5

    2c9c4787a65ee84fa523c3186144d5f8

    SHA1

    fa9b55c25422bad0f0047d1b934abf04ead7fd63

    SHA256

    da7405bbde7e3b581e9471a3ebce9c6d7b0882aff0a6619b62b3dd26d094d4b9

    SHA512

    0f4bf240afc9cf740b9e7302c6a0c2eee1f05b605d3c6a01e7f14756d1d7bac7a56c83b91fbcbb0b73766f991cdcdeaec9d38e378efd005805adcd8253395076

    Download Submit

  • C:\Users\Admin\Documents\OptimizeStep.doc.exe
    Filesize

    512KB

    MD5

    a7014e0f46e5ec95bb3cbcd91d980e3e

    SHA1

    2a24338621ecba9be35674deab7204d99739794c

    SHA256

    2d8c52cf46947890681b2f69e82bb990441d777bee5eb726488c950507dd30f8

    SHA512

    923d355b06bf20678b829941f909f06ea79e0fccde81b33b4a6b45896214e1246b47bd2742402f97c9424f9c85c1b924f98a81925d5759d439ee02dbb476faa3

    Download Submit

  • C:\Windows\SysWOW64\ctcunyxxajksr.exe
    Filesize

    512KB

    MD5

    0652930fbe513db2d6962652bf20a2bc

    SHA1

    aabfa7b3566228208a5da8be91302b8a28cf0a3b

    SHA256

    4ff6afcc816ad0e2c6f1621aa3c17bb422c47a833d85ad5156d9736b3dea1dd3

    SHA512

    3c4601a9492f9b95f91b27c17e315a151622c4bff15dc730c9b9983e2538f6dc99a0d6794299819cca2c3643e33d439cf7a21117527f7b20cdefb00c1714600a

    Download Submit

  • C:\Windows\SysWOW64\mxylpsyu.exe
    Filesize

    512KB

    MD5

    54509c762349d80e4ab1d0898d39dd72

    SHA1

    af230c810f366174332d643732396ee770c3c97e

    SHA256

    0b376584dff5c15ad32edfafb4a140ae9b5c3e2ca8b88ec8801a972808be22da

    SHA512

    052e9c7636c87c96dbaf5deef63828ab5dbb4b785771611f38f8fd2fa970327418bd8ae0f7de1a1bb22fb2402666244d78a745964695b2c11e3497e3325e42fd

    Download Submit

  • C:\Windows\SysWOW64\ovrkejbphqeuhfp.exe
    Filesize

    512KB

    MD5

    74c6d204d4bd1c863c9356ec7352d407

    SHA1

    148836ce05825383409738f359b967552178bc24

    SHA256

    c66892527a48f547d525e5725d8a5c43e2968729757dcd58fa3d005cddd31c3d

    SHA512

    4ed3fa35622c4b4adbae06899d26159598e360a2032d202c7a07c28fa0b06db136b9501953e4a97901801068bcf8a9316ff2066d5f71d80ccb1a415e266b4346

    Download Submit

  • C:\Windows\SysWOW64\xuduyanftz.exe
    Filesize

    512KB

    MD5

    31e71cbac0898dfb86788520b8aaee94

    SHA1

    eb51899bf1109e6c5ace4d5d0c6cb8dc7d29082a

    SHA256

    e1e5b579f21e63212f45d6d1ede1e6ecb0b92b00e88c2d99852b5c676a600bae

    SHA512

    ddf6ef6012fe846cd16014ef9680c9841157edd48cefe5033ebe8a53545196a5c2327fcb2af255f9b6594661c84e2ca07c01feef7cf4f9db5ff3352fb8781c13

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    a4fdece942ad98fc2efcfc1ec8b4029f

    SHA1

    5f6a78d5dff8e2efa48620f62fd4b3caa4477195

    SHA256

    ada8d128f2ae48121bf3f186f5ec6105c00997ff073c2dcdb0414ba8c71ed0e9

    SHA512

    5858198d64d4988273130fd0ef406e98107f2822275c94bb5b33d5bd3342de596e76812b73e416cb2b0d8e0ba6284a6b8d4ed40677fb61606118754b98eb66a7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    b9bfbd9a20c72ef074ddf6a244497742

    SHA1

    274e168faf625374396a7ef5aac391827d583bb7

    SHA256

    42af8d2195a4ff10592073f0e4510a08685d8ece6f504c283b0d4da3ffdf478b

    SHA512

    4c168454c21cdc5a79c2c4524ac884da0a62cbcbe587c1d9984221b728cd7451bae93ef8f690cc56606bad474fd01ee2e216bcf287226f4a4439e469616023d1

    Download Submit

  • memory/2828-37-0x00007FFC92E70000-0x00007FFC92E80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2828-39-0x00007FFC92E70000-0x00007FFC92E80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2828-38-0x00007FFC92E70000-0x00007FFC92E80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2828-36-0x00007FFC92E70000-0x00007FFC92E80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2828-42-0x00007FFC90A90000-0x00007FFC90AA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2828-43-0x00007FFC90A90000-0x00007FFC90AA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2828-35-0x00007FFC92E70000-0x00007FFC92E80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2828-607-0x00007FFC92E70000-0x00007FFC92E80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2828-606-0x00007FFC92E70000-0x00007FFC92E80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2828-609-0x00007FFC92E70000-0x00007FFC92E80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2828-608-0x00007FFC92E70000-0x00007FFC92E80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4772-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download