Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2024, 07:07

General

  • Target

    0977b291147568ba35b7b03fb04ac2bf_JaffaCakes118.exe

  • Size

    657KB

  • MD5

    0977b291147568ba35b7b03fb04ac2bf

  • SHA1

    938180244caa6dde3059d1320ccee1f20117fda3

  • SHA256

    5a34e94bb5cb2a260c290c4f630ab0a5c1bfe0a236fa28ed4f6269e7c80b57a8

  • SHA512

    5c94a3e5b8addc6d949b044c998dace62cd8cc396298e685e0095c893b95bec68f41eb0bc54cd645001a1f72dc458f08046520c9bc2e05e68546c98dbb6d7feb

  • SSDEEP

    12288:y0rruE+wG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Bjq4Wa/QTKJ8eP9/75uO7eU26tL:y0mwG4GQm4OaHYJ8eP4D5uOHBB24Wae8

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0977b291147568ba35b7b03fb04ac2bf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0977b291147568ba35b7b03fb04ac2bf_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3328
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 "C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release1005\ie\RichMediaViewV1release1005.dll" /s
      2⤵
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2544
    • C:\Windows\SysWOW64\gpupdate.exe
      "C:\Windows\System32\gpupdate.exe" /force
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3084
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    1⤵
      PID:884
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
        PID:3312

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release1005\ie\RichMediaViewV1release1005.dll

        Filesize

        85KB

        MD5

        e2094b10c7f2bfd3fcfe678e07263236

        SHA1

        79c04639e2f57ba523c9072f30ecd3fa96666ea6

        SHA256

        8f63bbf72260b0fb15fa8c6626f764d583e351445d1707975b96c52fca863f8e

        SHA512

        bf928cd4027241116d5f81fe25bf2844c084ce55c2882268b6ea72dcfd0621b978fabcceb2776704c10ed79a51c5afb9b852a9d0628f9213e00ad963e8e25d7c

      • C:\Users\Admin\AppData\Local\Temp\nsa9F8D.tmp\aminsis.dll

        Filesize

        567KB

        MD5

        450753ad96785a240a39deccab3af0d0

        SHA1

        21c544064d2ffa6444508268ce258a330d459fc5

        SHA256

        1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3

        SHA512

        c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab