Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

ff1e808477...18.exe

windows7-x64

7

ff1e808477...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/09/2024, 18:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ff1e80847730f04d88424713a4840be9_JaffaCakes118.exe

  • Size

    837KB

  • MD5

    ff1e80847730f04d88424713a4840be9

  • SHA1

    e5952dc0c93d098864432b146e850d1bdd0a13c4

  • SHA256

    5c489d125d1a085da30fe0a0ceb104adabcce6ee4df6583a79427e083ade9c63

  • SHA512

    5d12958244b47c81566d2c80d468c8da594b12643d3b7289327d18c8fe92b4424beac7b4aaaa9dcc0ad35eec6e27675ba4bc9a4b806163f4c5fb1d64ab6a39bf

  • SSDEEP

    24576:2pGwPIODWeTuPc2MQpjbM5ky6i4/2k6Vb:6TIEZqPc2MQpjbM5kZ0

Score
8/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 33 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff1e80847730f04d88424713a4840be9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ff1e80847730f04d88424713a4840be9_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4364
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 804
      2⤵
      • Program crash
      PID:2320
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 848
      2⤵
      • Program crash
      PID:5012
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1272
      2⤵
      • Program crash
      PID:2252
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1224
      2⤵
      • Program crash
      PID:780
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1288
      2⤵
      • Program crash
      PID:4188
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1416
      2⤵
      • Program crash
      PID:812
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1280
      2⤵
      • Program crash
      PID:4048
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1444
      2⤵
      • Program crash
      PID:4784
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1484
      2⤵
      • Program crash
      PID:840
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1952
      2⤵
      • Program crash
      PID:3104
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1284
      2⤵
      • Program crash
      PID:428
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4364 -ip 4364
    1⤵
      PID:5088
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4364 -ip 4364
      1⤵
        PID:4196
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4364 -ip 4364
        1⤵
          PID:1800
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4364 -ip 4364
          1⤵
            PID:2796
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4364 -ip 4364
            1⤵
              PID:1468
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4364 -ip 4364
              1⤵
                PID:1264
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4364 -ip 4364
                1⤵
                  PID:4592
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4364 -ip 4364
                  1⤵
                    PID:1960
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4364 -ip 4364
                    1⤵
                      PID:4724
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:4496
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:3060
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:5000
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:1008
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:2152
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:1804
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:5092
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:2184
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:1576
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:1960
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4148
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SendNotifyMessage
                        PID:4128
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2768
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:4792
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4364 -ip 4364
                      1⤵
                        PID:4832
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4364 -ip 4364
                        1⤵
                          PID:1660

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                          Filesize

                          471B

                          MD5

                          b24ff41c69a7d5c4b7698e50879708f5

                          SHA1

                          d10d5d36806c541db90f059e2f54b4f204da4d15

                          SHA256

                          a27c91dbc6192c34e7dd1aa221300fdd6d00271310616bac53118e5b64f0ca4c

                          SHA512

                          b64e4f2feb083e2cd3d76a4de01087a765163888ef8ca12ba008e0bd1bd5d01825464d041bf85b7d173cb1ae4d6c033f4386b27b41ceb0058222b910ed4a9734

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                          Filesize

                          420B

                          MD5

                          6469fb79b61c74c5161900f26557d63c

                          SHA1

                          0fe73a55971603a780fa9a0087774832fa0735f2

                          SHA256

                          2a84ae4357f6c344e6db4c11b0266e6aa48f9ae60840ffb4fe5c053846571e17

                          SHA512

                          2990a5c01ac081bbed33fffcbfeedeb64b6dab2b951dd97c09a12be9ed5f094e366632f15b3e442feea9164c5f9d3ca40f9134cfc79fc117dd89bd9b02a5b631

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                          Filesize

                          1022B

                          MD5

                          61ec92e853fb9cea2604dfab51a573c7

                          SHA1

                          30c9f6f1d0cf9d04bb31e4cbab9935b87c108063

                          SHA256

                          af5945e5484c4e6300df632bc2877f3fd972ff69203b9fe0389e04029e7bd2f8

                          SHA512

                          f1e85a115d72d89346cb6232a384b1f2dc90ea8e092e7a2ad5f04c14b5e98d8fe8d013a67c226a05421f0c65186e74ffb2c4bbf037cb3242f516fe8201d63fe7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\{ED3AD087-7BDB-4347-9072-39DCDF47C286}.png
                          Filesize

                          6KB

                          MD5

                          099ba37f81c044f6b2609537fdb7d872

                          SHA1

                          470ef859afbce52c017874d77c1695b7b0f9cb87

                          SHA256

                          8c98c856e4d43f705ff9a5c9a55f92e1885765654912b4c75385c3ea2fdef4a7

                          SHA512

                          837e1ad7fe4f5cbc0a87f3703ba211c18f32b20df93b23f681cbd0390d8077adba64cf6454a1bb28df1f7df4cb2cdc021d826b6ef8db890e40f21d618d5eb07a

                          Download Submit

                        • memory/3060-16-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4364-39-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-3-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-8-0x00000000009C8000-0x00000000009CA000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/4364-9-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-6-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-5-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-4-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-1-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-69-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-0-0x00000000009C8000-0x00000000009CA000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/4364-46-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-7-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-53-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-54-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-55-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-56-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-61-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-62-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-63-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-66-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-67-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4364-68-0x0000000000400000-0x0000000000A41000-memory.dmp

                          Filesize

                          6.3MB

                          Download

                        • memory/4792-37-0x00000000044F0000-0x00000000044F1000-memory.dmp

                          Filesize

                          4KB

                          Download