Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2024, 04:22

General

  • Target

    f52c7b690208a4fd9c3f2cc670e25375_JaffaCakes118.exe

  • Size

    747KB

  • MD5

    f52c7b690208a4fd9c3f2cc670e25375

  • SHA1

    44ae7cfe1d226ff41cb7bf07b797b189f136e15e

  • SHA256

    586512e8141469dac710fd7d0d7d35b94a7745c661d49a33ae625895c16a32c6

  • SHA512

    599b0bca0b27f7e2d50369aeb2c6717c30df0c4ad8863d959fe7c417f61ba7bc5aee2df06ea753d622d7f5957046b2bf4170bf9a8d6d680af9e9dbcb52da4513

  • SSDEEP

    12288:4soCYNrHi0tJICt3DIi0S80hrRZaqWR40rHeluaL0dUiuRm2Bao5:4soCYNrC2NJvhjyR4kKJRi0+4

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f52c7b690208a4fd9c3f2cc670e25375_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f52c7b690208a4fd9c3f2cc670e25375_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4308
    • C:\Windows\SysWOW64\PrstService.exe
      C:\Windows\system32\PrstService.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1564
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:17410 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4948
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\delus.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\E_4\Exmlrpc.fne

    Filesize

    34KB

    MD5

    387cf1d2f17aff6967f3107773764513

    SHA1

    b971bcd44988bee744f8133acb032e07d9dcd1db

    SHA256

    74c55aaee905be674763d679ca05a6baaf93f456b5d8935d6293e523766968c6

    SHA512

    19a4fb39b2f9863c92d76016290e701fd6bb1aa5d889896666922fd862d5b72b95a97aa27d3d0b3218233ba9dbcb3db147efbf9e61e5be853d4d3672e87bfd5c

  • C:\Users\Admin\AppData\Local\Temp\E_4\dp1.fne

    Filesize

    56KB

    MD5

    6649262561fba5d19f8b99dd251b5d02

    SHA1

    286e2ab6bc2220b3c9a83720c4c612623210e10f

    SHA256

    824afe6bde1c2890077e9a40c4261a77a1d736429709a45d68ed508581e74771

    SHA512

    688bd75b1e9661f425a21577063362e609ce496880a4780012317d56075095e5804fb7b849b32fbbea06fbbff5d47a5534113b6613f1a236b2a76cd043bba7ef

  • C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

    Filesize

    406KB

    MD5

    e79169d47394020f7c893abb840b61bb

    SHA1

    c5b9c2cbef3d5458b52ebb67461e84432673fb1b

    SHA256

    11c25cdeb02ac401d913dc48b935a087e32c2d9b7b7c4a5cfdf36e4947e959dc

    SHA512

    21ca64559082a31e46e28513de762fa2239c521f60b3485bf99926f895f0bf6f63fe2162c3e2eb25705efad22d351e24b8283442f4954ac88bc8c56ef5dc529a

  • C:\Windows\SysWOW64\PrstService.exe

    Filesize

    747KB

    MD5

    f52c7b690208a4fd9c3f2cc670e25375

    SHA1

    44ae7cfe1d226ff41cb7bf07b797b189f136e15e

    SHA256

    586512e8141469dac710fd7d0d7d35b94a7745c661d49a33ae625895c16a32c6

    SHA512

    599b0bca0b27f7e2d50369aeb2c6717c30df0c4ad8863d959fe7c417f61ba7bc5aee2df06ea753d622d7f5957046b2bf4170bf9a8d6d680af9e9dbcb52da4513

  • \??\c:\delus.bat

    Filesize

    230B

    MD5

    72504473241fb6647e9b3c242e37441a

    SHA1

    7431b89da9bccd4b304e48d1ac04a90ba473c527

    SHA256

    b567ca5370d027d49bad6abbc3d88e7016da39d3648468cc19718f0e03aa7d6c

    SHA512

    a798bc377697eb7e65253f34f4c215f108cf93e08a941b73a9fdf667063bcee28fa327ba743d4c2c3502e105dcc65ce9417de04be5eb2571a49f8ca939b9ae93

  • memory/1564-26-0x0000000002360000-0x0000000002384000-memory.dmp

    Filesize

    144KB

  • memory/1564-33-0x0000000010000000-0x000000001012A000-memory.dmp

    Filesize

    1.2MB

  • memory/1564-50-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1564-49-0x0000000010000000-0x000000001012A000-memory.dmp

    Filesize

    1.2MB

  • memory/4308-5-0x0000000010000000-0x000000001012A000-memory.dmp

    Filesize

    1.2MB

  • memory/4308-30-0x0000000010000000-0x000000001012A000-memory.dmp

    Filesize

    1.2MB

  • memory/4308-31-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/4308-0-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB