Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

fa194653ad...18.exe

windows7-x64

10

fa194653ad...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 08:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fa194653ada608d5c37145813acd5715_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    fa194653ada608d5c37145813acd5715

  • SHA1

    7992964158202ed0a5a68cf970f8a8619dfaa87c

  • SHA256

    08c3c75b93f5ff45351e8f2ba9f4af4d7b13cb65093128065c08ed53933dc564

  • SHA512

    ce1a0974ff4f009a3fd5cd0bf3907a3fa2e5e6a81af13ba39486f489868ca65412ed064b383bcf6a853e93d98d490fcae3e9f008513e38e47e795761658a3928

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6w:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa194653ada608d5c37145813acd5715_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa194653ada608d5c37145813acd5715_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Windows\SysWOW64\kgfmlwjcnp.exe
      kgfmlwjcnp.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Windows\SysWOW64\mniohlgs.exe
        C:\Windows\system32\mniohlgs.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1864
    • C:\Windows\SysWOW64\obxtpvyjadeabns.exe
      obxtpvyjadeabns.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3884
    • C:\Windows\SysWOW64\mniohlgs.exe
      mniohlgs.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3412
    • C:\Windows\SysWOW64\bfhysfvchkmhi.exe
      bfhysfvchkmhi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4744
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1584
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4612,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
    1⤵
      PID:3448

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Privilege Escalation

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Defense Evasion

    Hide Artifacts

    2
    T1564

    Hidden Files and Directories

    2
    T1564.001

    Impair Defenses

    2
    T1562

    Disable or Modify Tools

    2
    T1562.001

    Modify Registry

    6
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    4
    T1012

    System Information Discovery

    5
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      00e019980d9f778c40ad176da80fcd70

      SHA1

      837dd4635a80c66e79162ca83b2eb8c95d2c35b1

      SHA256

      fca151ea3967b3307a541acaeec7e202c79a4905d990deb45623d7be09822647

      SHA512

      25d8777bbc00c21bca2be99b23ec98726a99592bf6f077b8cd33a50da2f292ca480b817f8db5ca14032eaaf01d2d2a96b7da5e19ae8029209f8e52f8876ea355

      Download Submit

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      f5db4ad6dd2479dc42a4c4e71bbd4690

      SHA1

      952aeca1c32bf2887f4415f5e2f1f3602b805878

      SHA256

      6b3f3e4308774c00b505fad8ccb2a6bda533f59b1441290a2c1dfc5d8e08e446

      SHA512

      ca7b75ddd5047f4f65d7366500979696332ccbab1c116e9919170252738ab15525513d778389eb770fe785148141aa1961a5cbd7b3a97d3d2e6e7a82fcd35c57

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\TCD8C98.tmp\gb.xsl
      Filesize

      262KB

      MD5

      51d32ee5bc7ab811041f799652d26e04

      SHA1

      412193006aa3ef19e0a57e16acf86b830993024a

      SHA256

      6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

      SHA512

      5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
      Filesize

      332B

      MD5

      60d713c2b9bb1b4529d5a3ed5b60f6d6

      SHA1

      7183e8e0cda428a25ff26c00006e9acb5b0ce6bb

      SHA256

      5d5bc2baa5b11af37649f1d2d20a1c259bab9df1024eb9ffa759b250527b5cd2

      SHA512

      b59ea21d714ba8375f0e8b69b238d98a59a7e318ebafeea9d378fd0f025ad00f12077394ccfddec24a102aa7d76f8b53d703a91499b43b4ea67261085bb20ec8

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
      Filesize

      1KB

      MD5

      3980dac96259b77c68118b6e3229cbb5

      SHA1

      6341dca39bbaa43f491d2d5bc020b9661adce176

      SHA256

      0f2ec36f038c168eb189fb13e413968314047b6edb9df84b1ff45298508ca43b

      SHA512

      8908f08f9558caf8e6d1ac49be9c18f7a02263a461ad6388c993f7c79ec54b5de8c840f97556705639c1d2716158653e8784941ef80dac6bc3751d9f53cc0502

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
      Filesize

      1KB

      MD5

      69a1966aae2a47b87c0994c93377dd6d

      SHA1

      3deac3a9458609d172e7fa7b24cb865bc851f90d

      SHA256

      134b42202cf99571b517f94b113d5b7ad0b866f112f0845aa82bb002fa2f8d05

      SHA512

      bd7a29b7b9ef8cfc11479644b75bbb85619157c3ffa84719a6a8e20fb053098756fdfda772bcaba8d75770c408c423a990bb48caf3075d59eb902be42c27270f

      Download Submit

    • C:\Users\Admin\Documents\LimitCheckpoint.doc.exe
      Filesize

      512KB

      MD5

      e6b643f37175454416a1b9e206215a71

      SHA1

      4429162b13a1373b50a44256ddfb049c12e8fb8a

      SHA256

      a86064302519bfb056c1dfe25f490e199f9eb77d4ba8b1cd28b8fdb8fb1baf2f

      SHA512

      59f4eef276d3fd454925dbb399982d6d8e362228de4445a85937f6ed75a7b5a73886e3bd1082545bf103b40d846f301af1274f954b0d487dba650a7ea5c211e2

      Download Submit

    • C:\Users\Admin\Documents\NewClose.doc.exe
      Filesize

      512KB

      MD5

      9eebe36f569e1031170d8104e68c22ce

      SHA1

      2df225bffad7c2b4b917d80475b6ad2efe8e8321

      SHA256

      54218c33d4e8095f8867125d969101ab3aa54dff050c024772ea2733e179b7bf

      SHA512

      b6929246030151bbd0014c4075458e478210eeea0466ccd2bfb51e347cfffad258c6b68a76ba24885411034833bdbcb885a3e3703e44cd7bc939a236615c56c9

      Download Submit

    • C:\Windows\SysWOW64\bfhysfvchkmhi.exe
      Filesize

      512KB

      MD5

      8b9d3859c2c3adc8a735b13f9b7f9610

      SHA1

      4032b59b1567fa4617afd5ce3d90e343a16a2919

      SHA256

      b9a3516fb6c639c9b6790163e93ed03d1d9aca66db9769d8c51889015501342f

      SHA512

      6805cf43d374b19fedd1871f0c6437e1634a862203d675cfa4d61535be04b8a02a9c0d4deae879dc6bfef6c13045f327949efeb23f9fab52638614f021700314

      Download Submit

    • C:\Windows\SysWOW64\kgfmlwjcnp.exe
      Filesize

      512KB

      MD5

      59c17fb6307cb621831de8ddcec81fde

      SHA1

      347e157402689fc342d993377b20bec59e7a9814

      SHA256

      039ad6268e71799bac3ccc2d0ffeb0f8a348baa208e603382316cf9a60b0192c

      SHA512

      c38db6d7f2df7ca31b8eae5032b765abdcb18d4ee2f572f094c55d7d4266333c5691ca4419bd5f2c11bfd762995e08f8b6ebaae1f0ca7e47ffeab3a2d4aca3d1

      Download Submit

    • C:\Windows\SysWOW64\mniohlgs.exe
      Filesize

      512KB

      MD5

      1b01cdb2061244a413bd4b7ccbdd2680

      SHA1

      1f50a0695e088c9e073394f6ceec96f997a1a341

      SHA256

      100631ca41a20a100c2b52a41d7db13e4ae63f986e63f0b0ed39d438ab229314

      SHA512

      1fd42c64ba51d385ec452b1c87a46ea4218624ef7fd205dfbbf15d832f2f86c2b68b7d5a41adb157c91d74820f3fd9edadeb089240853a139dfc9d6a43b4ff56

      Download Submit

    • C:\Windows\SysWOW64\obxtpvyjadeabns.exe
      Filesize

      512KB

      MD5

      5d9ac8bbc6c46dc8c4d6eab7da807642

      SHA1

      1cfabe28977c3b9f7eb4f9202db0ba8492827391

      SHA256

      06ddd94d7fc2c1f17de61cb1ca068662488b0722052ac9b41c21bf826506caa9

      SHA512

      d52b60c90a2842cc777e12f1744b0f7fa25963e0dacac0bae79a55f1b685e217b6a71d4327fbbe2eedf46686ad96b006cf852847ddf9fc7e3b7b0a4c0583be68

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
      Filesize

      512KB

      MD5

      c6c8d1922ef4f12221bd8f8257aed41f

      SHA1

      52e338ae28de90047f493877298f82676f82b916

      SHA256

      6c164a28b692baebe19ae235456f111b2a2ed2ee4121ca6901d5d891e42b6b0b

      SHA512

      a1c7a4b11f72bf6fb89a103e797e203fd62cc6503b46b84bb4d6740f2cc74f881bea8457227706825cefbb8593cb3137710773631ed36273141532e41486c93b

      Download Submit

    • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
      Filesize

      512KB

      MD5

      15f473bc5e4462a8f781a0d61b060f81

      SHA1

      cdb485a148c3bfa0607347ac81f9a6a3bf245d01

      SHA256

      9957bf90835a979455a67fea53983bb57c6d70fac291986696f33ee052f2ebbf

      SHA512

      b2873864dec60775f722afc37f1d27d76be4330ee115789b84bccd37f1b542580bd370298b5d2d8dcd1292e88889a0097f064d93c8b20d6f87a978a65538bfc3

      Download Submit

    • memory/1496-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/1584-39-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1584-38-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1584-36-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1584-37-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1584-35-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1584-40-0x00007FFDC7400000-0x00007FFDC7410000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1584-41-0x00007FFDC7400000-0x00007FFDC7410000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1584-629-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1584-632-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1584-631-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1584-630-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

      Download