Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2024, 07:45

General

  • Target

    00396e4da96a97766313a548570b5d35_JaffaCakes118.exe

  • Size

    91KB

  • MD5

    00396e4da96a97766313a548570b5d35

  • SHA1

    a04ca242e2cf71dee431ccd809e943404a5a1e1a

  • SHA256

    274788c12871c80676d9f04190bfc3f551952dbe8f32fb7459dff1138fdcecad

  • SHA512

    97eec73a60fdbfd5075f615c1a3e22745712a3d1a8394ea0aa774c7525ab2f70a813633f2e5c2976390fd0eb67690655eb66ff6546295fecbbdd2313e9a82a90

  • SSDEEP

    1536:BpzdwtSeLldxi4DV3KkYgurpMg1rfzH1fI/Y4OPzb4r9Y56iHVCc:BpzaLiuFKXXr11rfzH2/OPv4rirYc

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 27 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00396e4da96a97766313a548570b5d35_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\00396e4da96a97766313a548570b5d35_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:740
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /installservice
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4820
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /start
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:2916
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\00396e4da96a97766313a548570b5d35_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies registry class
      PID:3676
  • C:\Windows\SysWOW64\urdvxc.exe
    "C:\Windows\SysWOW64\urdvxc.exe" /service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:2464
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4148,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
    1⤵
      PID:3640
    • C:\Windows\SysWOW64\urdvxc.exe
      "C:\Windows\SysWOW64\urdvxc.exe" /service
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Modifies registry class
      PID:1780

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Java\jdk-1.8\README.html

      Filesize

      263B

      MD5

      8e0789ff750b413c70a9b109432cf0ba

      SHA1

      84c429f3b741a44bced2a137ee62254348e89da6

      SHA256

      f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1

      SHA512

      36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899

    • C:\Program Files\Java\jdk-1.8\jre\Welcome.html

      Filesize

      1KB

      MD5

      779a07a850ecaa15f9556df0211aa812

      SHA1

      71d9bd8ddd02550e263f029291fc735ea867f665

      SHA256

      d49edd4335ae9fbe53d4d8b491b9b9af4f9647df9258b640ce6fa027516bac84

      SHA512

      4e0b47bd5c474cfd32cc0c723b50282fbcba3e1488420d3a2dcdaaa7680d6b2498d04e10767545fa63f9fba8f2711954dffafe52894593b4cb5ca1735f0c773d

    • C:\Program Files\Java\jre-1.8\Welcome.html

      Filesize

      1KB

      MD5

      52e99cc30914764f3867bc215a9d13dc

      SHA1

      425f866da470c4f193ba59bf684a7ed935e4e362

      SHA256

      84bd3a74cdd13061a66e9140a0f80e5b025a06d5a9211d713dd46843cba43b7d

      SHA512

      eae15d105533d0aa597417ee8781fb81b33af2ccfd546c1df462a148894ac8efbcbc27e20d427ca94e6193c81bc31fd5ac1b3ac10898e4844c66f3b41c88ab7a

    • C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html

      Filesize

      1KB

      MD5

      75887f366667b2254dfd35014d4eb318

      SHA1

      03127bc21514e315f8c370a9ac5dbd1cd9e766e7

      SHA256

      fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9

      SHA512

      953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979

    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM

      Filesize

      11KB

      MD5

      4c7125f69cf2046a45daeac49cb0019f

      SHA1

      b4b17fbe1091003ed480f40654f22c89c763f01b

      SHA256

      1102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d

      SHA512

      ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62

    • C:\Windows\SysWOW64\urdvxc.exe

      Filesize

      91KB

      MD5

      00396e4da96a97766313a548570b5d35

      SHA1

      a04ca242e2cf71dee431ccd809e943404a5a1e1a

      SHA256

      274788c12871c80676d9f04190bfc3f551952dbe8f32fb7459dff1138fdcecad

      SHA512

      97eec73a60fdbfd5075f615c1a3e22745712a3d1a8394ea0aa774c7525ab2f70a813633f2e5c2976390fd0eb67690655eb66ff6546295fecbbdd2313e9a82a90

    • memory/740-37-0x0000000000600000-0x000000000061F000-memory.dmp

      Filesize

      124KB

    • memory/740-0-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/740-1-0x0000000000600000-0x000000000061F000-memory.dmp

      Filesize

      124KB

    • memory/1780-2449-0x00000000001C0000-0x00000000001DF000-memory.dmp

      Filesize

      124KB

    • memory/1780-1957-0x00000000001C0000-0x00000000001DF000-memory.dmp

      Filesize

      124KB

    • memory/2464-52-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-58-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-25-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-26-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-27-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-28-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-29-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-30-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-31-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-32-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-33-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-34-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-35-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-12-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-13-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-23-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-39-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-17-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-41-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-42-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-43-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-44-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-45-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-46-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-47-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-48-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-49-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-50-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-51-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-22-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-53-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-54-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-55-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-56-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-57-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-24-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-59-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-18-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-61-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-62-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-63-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-64-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-65-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-66-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-67-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-68-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-69-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-70-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-71-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-72-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-73-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-74-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-75-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-76-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-77-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-78-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-79-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-80-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-81-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-305-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-1955-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-21-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-20-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2464-19-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/2916-10-0x00000000001C0000-0x00000000001DF000-memory.dmp

      Filesize

      124KB

    • memory/3676-60-0x00000000001C0000-0x00000000001DF000-memory.dmp

      Filesize

      124KB

    • memory/3676-40-0x00000000001C0000-0x00000000001DF000-memory.dmp

      Filesize

      124KB

    • memory/3676-38-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/4820-6-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/4820-7-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/4820-8-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB