Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2024, 21:31

General

  • Target

    0353871daee0ec99643055837b8d48fe_JaffaCakes118.dll

  • Size

    204KB

  • MD5

    0353871daee0ec99643055837b8d48fe

  • SHA1

    592925ded3a302c833628055fba0b9265a5c693e

  • SHA256

    d492b2e481db1161344dc61215ba9078d041caf2e36d6b130d4decfcacd984de

  • SHA512

    af541a0a6825ab42993fd0d3eb7ce7cc9f14ff055569802a2c894c4c34378562ecd4f6d11f6346ee4d2ea05e2caa49419a3101cdb4abad47fb067bb8aefeed0c

  • SSDEEP

    3072:5EHoq7ox0HVMaJzvskxu2QnDqnZAn7jniSmj33iML0vPfBOj2hE0ScLXUh0nCpr4:iDDpxanDqZAn7KHFYvBOihEeLX/nJ/r

Score
8/10

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer Protected Mode 1 TTPs 15 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 45 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0353871daee0ec99643055837b8d48fe_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0353871daee0ec99643055837b8d48fe_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer Protected Mode
      • Modifies Internet Explorer Protected Mode Banner
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1728
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2736
      • C:\Windows\SysWOW64\notepad.exe
        notepad.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        PID:4920
      • C:\Windows\SysWOW64\notepad.exe
        notepad.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        PID:4816
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4124
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
    1⤵
      PID:5080
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
      • System Location Discovery: System Language Discovery
      PID:1896
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2140
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:17410 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4904

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      471B

      MD5

      5c93309a2b418ef7de0afb3ae82770c2

      SHA1

      1b9d1a371d163274c3831c764f18ce33f529e5f6

      SHA256

      fa0eff22a494037462bc32f5f477044d28d8e7795b8e2ee7724dbe0c646f2b22

      SHA512

      08d71c4cd9ff5df8c53b83bc24fa1ef42c3c205ed08b3a3d38fbc737a68083241c0230a942336f76d0aeb3bf7ffcdc8b8e4f3f82f9f3eba1c7e47af83802af76

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      404B

      MD5

      501af12e9c21db950b00fefd23fab1d2

      SHA1

      57f8e84b6c51a3ace56e6e5100292173f2169afc

      SHA256

      14178462c30477777fafb35c475d3d40c03fb9719915fa96ec0cea180c0cadfa

      SHA512

      96abe8e7b2b06f70665f8972ad207cd2cecd6a5fc5cf2f1738804e75a80e2aaba3abe60e1e9fb75f4a743f47ac3dd0747993c29a1af0ed31650fc4a62270b9a6

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA4C.tmp

      Filesize

      15KB

      MD5

      1a545d0052b581fbb2ab4c52133846bc

      SHA1

      62f3266a9b9925cd6d98658b92adec673cbe3dd3

      SHA256

      557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

      SHA512

      bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZK5NPJWQ\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    • memory/1728-1-0x0000000002300000-0x0000000002336000-memory.dmp

      Filesize

      216KB

    • memory/1728-2-0x0000000002380000-0x00000000023B1000-memory.dmp

      Filesize

      196KB

    • memory/1728-0-0x00000000022C0000-0x00000000022F1000-memory.dmp

      Filesize

      196KB

    • memory/1728-8-0x00000000022C0000-0x00000000022F1000-memory.dmp

      Filesize

      196KB

    • memory/1728-9-0x0000000002300000-0x0000000002336000-memory.dmp

      Filesize

      216KB

    • memory/1728-10-0x0000000002380000-0x00000000023B1000-memory.dmp

      Filesize

      196KB

    • memory/1728-11-0x0000000002380000-0x00000000023B1000-memory.dmp

      Filesize

      196KB

    • memory/4920-5-0x0000000004880000-0x00000000048B1000-memory.dmp

      Filesize

      196KB

    • memory/4920-7-0x0000000004880000-0x00000000048B1000-memory.dmp

      Filesize

      196KB

    • memory/4920-6-0x0000000004880000-0x00000000048B1000-memory.dmp

      Filesize

      196KB

    • memory/4920-4-0x0000000004880000-0x00000000048B1000-memory.dmp

      Filesize

      196KB