Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
9Static
static
9f65e79bb74...18.exe
windows7-x64
7f65e79bb74...18.exe
windows10-2004-x64
7$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...om.dll
windows7-x64
5$PLUGINSDI...om.dll
windows10-2004-x64
5$PLUGINSDI...ry.dll
windows7-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$TEMP/v.vbs
windows7-x64
3$TEMP/v.vbs
windows10-2004-x64
3$TEMP/xcmd.exe
windows7-x64
9$TEMP/xcmd.exe
windows10-2004-x64
9$_48_/$APP...md.exe
windows7-x64
9$_48_/$APP...md.exe
windows10-2004-x64
9$_48_/1.html
windows7-x64
3$_48_/1.html
windows10-2004-x64
3$_48_/3.bat
windows7-x64
1$_48_/3.bat
windows10-2004-x64
1$_48_/3.vbs
windows7-x64
4$_48_/3.vbs
windows10-2004-x64
7$_48_/qq.vbs
windows7-x64
3$_48_/qq.vbs
windows10-2004-x64
7Analysis
-
max time kernel
125s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 16:05
Behavioral task
behavioral1
Sample
f65e79bb74f99ef872a313579bf2d3db_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f65e79bb74f99ef872a313579bf2d3db_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/MakeDll.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/MakeDll.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/registry.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$TEMP/v.vbs
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$TEMP/v.vbs
Resource
win10v2004-20240910-en
Behavioral task
behavioral21
Sample
$TEMP/xcmd.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
$TEMP/xcmd.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$_48_/$APPDATA/xcmd.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$_48_/$APPDATA/xcmd.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$_48_/1.html
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
$_48_/1.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$_48_/3.bat
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
$_48_/3.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
$_48_/3.vbs
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
$_48_/3.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
$_48_/qq.vbs
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
$_48_/qq.vbs
Resource
win10v2004-20240910-en
General
-
Target
$_48_/3.vbs
-
Size
2KB
-
MD5
b4eccc20dfcca0c00d93830d76973361
-
SHA1
21d4f2968c988bfc770e0940df5bb55ab5d17705
-
SHA256
b0a86922d04f36b8318711f340fcb6cbdfe5e380fb73c45b7cf2b15c3139780b
-
SHA512
534d9f71a165f9a52d2cb593f1e20d9c44758b394c3d3a96437850f5b8db228324bc92d400fbbc3cb85c9d2f17e17c3a9ab734eadcd9dcc1c3229c5e0014d535
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\NetMeeting\ie.html WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2804 wrote to memory of 1128 2804 WScript.exe 91 PID 2804 wrote to memory of 1128 2804 WScript.exe 91 PID 2804 wrote to memory of 228 2804 WScript.exe 93 PID 2804 wrote to memory of 228 2804 WScript.exe 93 PID 228 wrote to memory of 2236 228 cmd.exe 95 PID 228 wrote to memory of 2236 228 cmd.exe 95 PID 228 wrote to memory of 4612 228 cmd.exe 96 PID 228 wrote to memory of 4612 228 cmd.exe 96 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1128 attrib.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\$_48_\3.vbs"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" "C:\Program Files\NetMeeting\ie.html" +R2⤵
- Views/modifies file attributes
PID:1128
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y| cacls "C:\Program Files\NetMeeting\ie.html" /P Everyone:R2⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2236
-
-
C:\Windows\system32\cacls.execacls "C:\Program Files\NetMeeting\ie.html" /P Everyone:R3⤵PID:4612
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4036,i,1729213506309163284,12809566808978835441,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:81⤵PID:660