Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe
-
Size
939KB
-
MD5
ef706e60b202ee7d320f0cd9cbdec1b9
-
SHA1
64a34f5e436ae0df2c476c8239072f4333eaac69
-
SHA256
0867aae175ae9035b4e452386923c8b6e2ceefe8fd37b850f2b5a88e91a71f1d
-
SHA512
2725dbabaa5a4b8da258da17bea6c7bde7950591026cf6058551235214c635fba430d1fac4534da237117064c882f5e635c3c611223c2efa1df52641c2bad101
-
SSDEEP
12288:LtsyVG0Yco+gunQUBCEAWfykqVNeN24epxozOJhaXL3F2Soypj:La+G7ZunQU1aVNeN2joz8hEL3cSJp
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
wtfomg88
Signatures
-
Detected Nirsoft tools 9 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/3812-21-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral2/memory/2952-31-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral2/memory/2952-32-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral2/memory/3792-39-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/228-49-0x0000000000400000-0x000000000043D000-memory.dmp Nirsoft behavioral2/memory/1840-58-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral2/memory/3876-65-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral2/memory/2196-70-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral2/memory/2196-72-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft -
Executes dropped EXE 7 IoCs
pid Process 3812 Dialup.exe 2196 Firefox.exe 2952 Microsoft.exe 3792 InternetExplorer.exe 228 Chrome.exe 1840 Opera.exe 3876 Dialup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000800000002347a-15.dat upx behavioral2/memory/3812-16-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/3812-21-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/files/0x000700000002347e-24.dat upx behavioral2/memory/2196-26-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral2/files/0x000700000002347f-30.dat upx behavioral2/memory/2952-31-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/2952-32-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/files/0x0007000000023481-35.dat upx behavioral2/memory/3792-39-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/files/0x0007000000023483-42.dat upx behavioral2/memory/228-44-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral2/memory/228-49-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral2/files/0x0007000000023484-52.dat upx behavioral2/memory/1840-58-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral2/memory/3876-65-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/2196-70-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral2/memory/2196-72-0x0000000000400000-0x0000000000419000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 whatismyip.com -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InternetExplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dialup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dialup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Microsoft.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2952 Microsoft.exe 2952 Microsoft.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe Token: SeDebugPrivilege 2952 Microsoft.exe Token: SeDebugPrivilege 3792 InternetExplorer.exe Token: SeRestorePrivilege 3792 InternetExplorer.exe Token: SeBackupPrivilege 3792 InternetExplorer.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1964 wrote to memory of 3812 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 85 PID 1964 wrote to memory of 3812 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 85 PID 1964 wrote to memory of 3812 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 85 PID 1964 wrote to memory of 2196 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 86 PID 1964 wrote to memory of 2196 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 86 PID 1964 wrote to memory of 2196 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 86 PID 1964 wrote to memory of 2952 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 87 PID 1964 wrote to memory of 2952 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 87 PID 1964 wrote to memory of 2952 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 87 PID 1964 wrote to memory of 3792 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 88 PID 1964 wrote to memory of 3792 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 88 PID 1964 wrote to memory of 3792 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 88 PID 1964 wrote to memory of 228 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 89 PID 1964 wrote to memory of 228 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 89 PID 1964 wrote to memory of 228 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 89 PID 1964 wrote to memory of 1840 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 90 PID 1964 wrote to memory of 1840 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 90 PID 1964 wrote to memory of 1840 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 90 PID 1964 wrote to memory of 3876 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 92 PID 1964 wrote to memory of 3876 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 92 PID 1964 wrote to memory of 3876 1964 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\Dialup.exeC:\Users\Admin\AppData\Local\Temp\Dialup.exe /stext C:\Users\Admin\AppData\Local\Temp\Dialup.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3812
-
-
C:\Users\Admin\AppData\Local\Temp\Firefox.exeC:\Users\Admin\AppData\Local\Temp\Firefox.exe /stext C:\Users\Admin\AppData\Local\Temp\Firefox.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2196
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft.exeC:\Users\Admin\AppData\Local\Temp\Microsoft.exe /stext C:\Users\Admin\AppData\Local\Temp\Microsoft.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Users\Admin\AppData\Local\Temp\InternetExplorer.exeC:\Users\Admin\AppData\Local\Temp\InternetExplorer.exe /stext C:\Users\Admin\AppData\Local\Temp\InternetExplorer.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3792
-
-
C:\Users\Admin\AppData\Local\Temp\Chrome.exeC:\Users\Admin\AppData\Local\Temp\Chrome.exe /stext C:\Users\Admin\AppData\Local\Temp\Chrome.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:228
-
-
C:\Users\Admin\AppData\Local\Temp\Opera.exeC:\Users\Admin\AppData\Local\Temp\Opera.exe /stext C:\Users\Admin\AppData\Local\Temp\Opera.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1840
-
-
C:\Users\Admin\AppData\Local\Temp\Dialup.exeC:\Users\Admin\AppData\Local\Temp\Dialup.exe /stext C:\Users\Admin\AppData\Local\Temp\Dialup.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
125KB
MD59b3b1c0db965166319469b2afa6c4f0c
SHA19f1e65a3056dff872949329c4e5e70c007cc5621
SHA256dbfa10a7deeb6d1ac8fd95ffeb23b87adc58e6388e522812fabe7f710e3cdd89
SHA512c11512599b83fa1875a67915a7e7454512ed8300a0a47c16692ebc1f526755c39c795fe9721dd97d417bfcb29f9e4c1f3283cf4c426af6571b3996005f7e4f5e
-
Filesize
37KB
MD59c8872c879d0a9d82988920488370864
SHA187ff4231547462e6474c832e28831dd691d83fd4
SHA2568f576d5191721f8fdb47bb22950f43fc8f2c9cc880fe067090ed96e6fcb07a97
SHA5123c413427c46ef92a412840479896841ffd5c6eb9215b8ecc416cdbd4f8e0f2eb643ed3b7f2e18eb5710ba7c55e1cd82af6637285ee364e069503c5ecc187cb2e
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
37KB
MD5a1d6a37917dcf4471486bc5a0e725cc6
SHA15b09f10dc215078ae44f535de12630c38f3b86e3
SHA2568a06acd1158060a54d67098f07c1ff7895f799bc5834179b8aae04d28fb60e17
SHA5125798a5d85052d5c2f6b781b91a400c85bc96c0127cc4e18079bff1f17bd302dc07c0f015ddf1105621a841680057322eb0172ba06063f55d795b7b079f1d26d2
-
Filesize
42KB
MD528c110b8d0ad095131c8d06043678086
SHA1c684cf321e890e0e766a97609a4cde866156d6c5
SHA256dbc2216d5f31f5218e940e3d802998dee90eeb69af69cbeb063c69c6a5a3f1e1
SHA512065e043b76b0e1163e73f4a1c257bae793ae9b46bff1951956c2174ef91deb2528730da77aab76b9e7246d705c3b8c1d23f05dc3b161cacabf3e52d0f563c922
-
Filesize
63KB
MD5fbb93d4c91453b06414d6973152d904e
SHA14624232c5450e7e9e7ba1f2113a07f8800dc5b5f
SHA2568898b138a3f238fa985992a9d0e48f6b5865dd2cc35e08b83fa326260c510ffe
SHA5124ed926d230af576a945bdd4d9b2d4001e8036abbcf1ef9a35669823d9420b6d95b426d80384a6fd022165c1fc2485fda0e28193b99b301927236928ddfcac6f7
-
Filesize
38KB
MD537a89021ab1fbe5668c3974abc794bd4
SHA18ccaa4406f907a5a938fbb2db9d5af27092b811d
SHA2562cb9a3d9587f79a6b1cfa95020b81d7d0d3cf9aa6ebf992f3b5e4ecf19bca8a8
SHA5126eaef2c2c29eb5363a0193489dc989527e4087c61fe926efbbd8a0e3cc8b9675285a94d392ee0a906dfc109566cc144ab07166fd5b3defbfc8afd66d3fe8d1b8