Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

fab71c58e9...18.exe

windows7-x64

10

fab71c58e9...18.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 16:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fab71c58e9f2c32d021b4c8ef260100d_JaffaCakes118.exe

  • Size

    524KB

  • MD5

    fab71c58e9f2c32d021b4c8ef260100d

  • SHA1

    dfb8a221acfbe8d35da0c6bcee24a1e154e128a3

  • SHA256

    7710ace40fe233fce6e18c968719413b757ac496f8f8711c2e377a8c22b1831d

  • SHA512

    5ffb049311264b6513e53044940c2aa10ad68f73e4dbbdaea5b57fe44c642861745d8c3aa757a0dd24f93c51afd171ad3ce5b9308b807cfd4a6bb880683a9b7e

  • SSDEEP

    12288:MSFMFpuhRp8tmnkX4C4IosE/rSkU19Zt/kMM22:jF+u+gkX3o1jSkErM2

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 10 IoCs
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 6 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    PID:332
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\fab71c58e9f2c32d021b4c8ef260100d_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\fab71c58e9f2c32d021b4c8ef260100d_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Users\Admin\JB3O2vP3.exe
        C:\Users\Admin\JB3O2vP3.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Users\Admin\mofel.exe
          "C:\Users\Admin\mofel.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2004
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del JB3O2vP3.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1712
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2836
      • C:\Users\Admin\2sun.exe
        C:\Users\Admin\2sun.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2636
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2600
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2248
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1652
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          PID:1668
      • C:\Users\Admin\3sun.exe
        C:\Users\Admin\3sun.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:936
        • C:\Users\Admin\AppData\Local\615578cd\X
          *0*bc*b3299728*31.193.3.240:53
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1300
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1060
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del fab71c58e9f2c32d021b4c8ef260100d_JaffaCakes118.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:1288
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:680
  • C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
    1⤵
      PID:2896
    • C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      1⤵
        PID:1856

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\system32\consrv.dll
        Filesize

        29KB

        MD5

        1149c1bd71248a9d170e4568fb08df30

        SHA1

        6f77f183d65709901f476c5d6eebaed060a495f9

        SHA256

        c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

        SHA512

        9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

        Download Submit

      • \Users\Admin\2sun.exe
        Filesize

        128KB

        MD5

        cba16c1a489b02c4ff5720c68f35f787

        SHA1

        bd3d817f02e1492d246c067a6ddf3e0ec33d86c3

        SHA256

        0235b18287b0a3833cb877713019c2679a7699b2c848b16bfdf50244f8556e80

        SHA512

        00740a1e2bd2bba0f4f2486914fe1c885064d5dc6389561697e357a354e8cdc6707f4bd542c02179020ef69c6d9f1d3503eaf0111bb9c1eba1a64a194cb9c345

        Download Submit

      • \Users\Admin\3sun.exe
        Filesize

        278KB

        MD5

        345cbbd3a56a313f804b997f8cbecb2b

        SHA1

        9978d6f5bca8ab1486573ff073661e7cfd40c365

        SHA256

        492c8cf86fcfa07fcf5716b17593a9ec265c5aa919c2fe563a34ece1580b055c

        SHA512

        5cdb8b00ab0d653a34b3d1b2871ebeb0badfe223779dce775adf00d577a2931f77c1e6d92cda719e32a8683f6f729179f128472efdf6ec0ac18cbdbcfbbc237d

        Download Submit

      • \Users\Admin\AppData\Local\615578cd\X
        Filesize

        38KB

        MD5

        72de2dadaf875e2fd7614e100419033c

        SHA1

        5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

        SHA256

        c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

        SHA512

        e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

        Download Submit

      • \Users\Admin\JB3O2vP3.exe
        Filesize

        228KB

        MD5

        290d691efc05b13247d2f6d8952a215b

        SHA1

        a885524eae321c2d025dd8e2fe4c8dd76dfb0ca0

        SHA256

        43b951fb64328c15a0592d228e90f05be14b4f18a902c35b5c0451020e1d82be

        SHA512

        8dfdcdd93b47db1b490a80fd1c483e5f10d18d782f34562bf7313039040c69878fb1d6ad22f1b3d6e48dcc8db507c430f11b1a976b48f9cd1769400fba4c150e

        Download Submit

      • \Users\Admin\mofel.exe
        Filesize

        228KB

        MD5

        885b72b2626841a9609620b806ac3fb7

        SHA1

        8d6d071069546e56e5012bafa58b5d12c3b91564

        SHA256

        76ec9b907a5dcc8072959f5becbb422234d061e890f3679cf7b6b4c285d02ac0

        SHA512

        fee0c682a9d22c6182c933ab753fd633443de8fa3ea9dfed3c1f6661a581f104ac612809cd20b8f58199555dcb294bc5c57a7509eba8a3223e238fb979a5b076

        Download Submit

      • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
        Filesize

        2KB

        MD5

        a6fb3c7ae7e2fdf8000eee97bb2d2411

        SHA1

        40bf52c55bc655e48a2337cf642bbac28e3cec8d

        SHA256

        10b1e83c2a5b056eff6aa1163711f7ad440c453d91d0c6f446121b257d43f647

        SHA512

        6cb494b437d561f24f9c8d84b72f8ce882f5f5418bd086c0a6dbf758d002788f4f227c7e7903e108008200be2edb6c4f6b1c508076d8d0bbb2cef21922cff868

        Download Submit

      • memory/332-115-0x0000000002530000-0x000000000253B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1192-122-0x0000000002D20000-0x0000000002D2B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1192-131-0x0000000002D30000-0x0000000002D3B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1192-130-0x0000000002D20000-0x0000000002D2B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1192-126-0x0000000002D20000-0x0000000002D2B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1192-100-0x0000000002D00000-0x0000000002D06000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1192-108-0x0000000002D00000-0x0000000002D06000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1192-104-0x0000000002D00000-0x0000000002D06000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1652-83-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/1652-141-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/1652-79-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/1652-87-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/1652-77-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/1652-88-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2248-61-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2248-81-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2248-74-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2248-73-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2248-69-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2248-65-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2248-63-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2600-59-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2600-68-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2600-56-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2600-71-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2600-72-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2600-49-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2600-54-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2636-45-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2636-52-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2636-47-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2636-48-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2636-42-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2636-40-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2636-136-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2636-44-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2636-38-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download