Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2024, 09:29

General

  • Target

    0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe

  • Size

    45KB

  • MD5

    0a0032a860c7ae456b91400703be4a4c

  • SHA1

    78b76d9fdfbbd43f70937a9025371d279593752e

  • SHA256

    ef52a3d099bbf90addc13d1aec8fb29d27091192ed156f6510673a104336c707

  • SHA512

    31a657e9e39f86ca37c22a7ad9ead0c218704d2720cbbc351a060cecff3893145cf4a9a1f929b2fcd791bb4d13b44438a4f82e323f4e60a69e76825c207f2f40

  • SSDEEP

    768:E1AuwHyeFo6NPIFAoslbf8eRYLGXdoIFbb5omuKWcbsvwnoT9D88888888888JXf:EOxyeFo6NPCAosxYyXdF5oy3VoKf

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 8 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 21 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 28 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\recycled\SVCHOST.EXE
      C:\recycled\SVCHOST.EXE :agent
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\recycled\SVCHOST.EXE
        C:\recycled\SVCHOST.EXE :agent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2596
      • F:\recycled\SVCHOST.EXE
        F:\recycled\SVCHOST.EXE :agent
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\recycled\SVCHOST.EXE
          C:\recycled\SVCHOST.EXE :agent
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1700
        • F:\recycled\SVCHOST.EXE
          F:\recycled\SVCHOST.EXE :agent
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2328
        • C:\recycled\SPOOLSV.EXE
          C:\recycled\SPOOLSV.EXE :agent
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1484
          • C:\recycled\SVCHOST.EXE
            C:\recycled\SVCHOST.EXE :agent
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2144
          • F:\recycled\SVCHOST.EXE
            F:\recycled\SVCHOST.EXE :agent
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1864
          • C:\recycled\SPOOLSV.EXE
            C:\recycled\SPOOLSV.EXE :agent
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2152
      • C:\recycled\SPOOLSV.EXE
        C:\recycled\SPOOLSV.EXE :agent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2924
      • C:\Windows\SysWOW64\userinit.exe
        C:\Windows\system32\userinit.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1684
        • C:\Windows\SysWOW64\Explorer.exe
          Explorer.exe "C:\recycled\SVCHOST.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2068
    • F:\recycled\SVCHOST.EXE
      F:\recycled\SVCHOST.EXE :agent
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2616
    • C:\recycled\SPOOLSV.EXE
      C:\recycled\SPOOLSV.EXE :agent
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2880
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.doc"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2432
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:716
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
        PID:1664

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Recycled\desktop.ini

        Filesize

        65B

        MD5

        ad0b0b4416f06af436328a3c12dc491b

        SHA1

        743c7ad130780de78ccbf75aa6f84298720ad3fa

        SHA256

        23521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416

        SHA512

        884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56

      • C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt

        Filesize

        1KB

        MD5

        0269b6347e473980c5378044ac67aa1f

        SHA1

        c3334de50e320ad8bce8398acff95c363d039245

        SHA256

        68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2

        SHA512

        e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b

      • C:\begolu.txt

        Filesize

        2B

        MD5

        2b9d4fa85c8e82132bde46b143040142

        SHA1

        a02431cf7c501a5b368c91e41283419d8fa9fb03

        SHA256

        4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142

        SHA512

        c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be

      • C:\recycled\SPOOLSV.EXE

        Filesize

        45KB

        MD5

        797817af831861c9df0fc0ff2b8ff654

        SHA1

        7b9d67c96c9f39a570a2dad57f70eedbdb7402cf

        SHA256

        d39672eabfddf3d85104c0c9019ae371c15d52f5119e538b18f34322208b951e

        SHA512

        22c81d387987128edf13a6dbd8f7635565876358d3425fa70556ad8a550d7dc6ae01a00c763ac63ac5c8013775bf49b561abb2fcbf0c10b485c9cfa13983a93b

      • F:\Recycled\SVCHOST.EXE

        Filesize

        45KB

        MD5

        cec74ba5135fb9d6ff544599b54c1aa9

        SHA1

        67e13df222d9a65c93cacdb04709af42a6016488

        SHA256

        5140e2d139997e2ba6a2723bd01863efbee9f3d7a6eca23da63aed8d0d69c681

        SHA512

        3cfc863ae1748cb15abe386a60af2ec82759b80bf2251ddd1343ce0637f353a60bb84ae6075c3e7d10591ee7a5a33eceae0ae396d225f834414b8c6a8721233a

      • \Recycled\SVCHOST.EXE

        Filesize

        45KB

        MD5

        d44b372acea7c3815ea501a494a53c03

        SHA1

        9609138b39a0abb4d2c873f39827722d1e0519b5

        SHA256

        aba278b7d06bbc64213ee2d5806ee94abde38872766ad6cdab46a44d2e56c7f4

        SHA512

        01b6c0ef461935194233d5a2b37a5dcff5fa849b2bb3b5f33218020266e78817741b5ae0c4357f0b9d90529812149b40427c087630404bfe2e43195b4c48ede4

      • memory/1484-180-0x00000000004E0000-0x00000000004FA000-memory.dmp

        Filesize

        104KB

      • memory/1484-179-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/1484-69-0x00000000004E0000-0x00000000004FA000-memory.dmp

        Filesize

        104KB

      • memory/1484-81-0x00000000004E0000-0x00000000004FA000-memory.dmp

        Filesize

        104KB

      • memory/1484-184-0x00000000004E0000-0x00000000004FA000-memory.dmp

        Filesize

        104KB

      • memory/1700-52-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/1864-83-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/1864-77-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/1932-47-0x00000000004A0000-0x00000000004BA000-memory.dmp

        Filesize

        104KB

      • memory/1932-59-0x00000000004A0000-0x00000000004BA000-memory.dmp

        Filesize

        104KB

      • memory/1932-174-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/1932-62-0x00000000004A0000-0x00000000004BA000-memory.dmp

        Filesize

        104KB

      • memory/2144-74-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2152-86-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2328-56-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2432-111-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/2596-34-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2616-101-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2616-103-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2660-0-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2660-100-0x00000000003D0000-0x00000000003EA000-memory.dmp

        Filesize

        104KB

      • memory/2660-99-0x00000000003D0000-0x00000000003EA000-memory.dmp

        Filesize

        104KB

      • memory/2660-21-0x00000000003D0000-0x00000000003EA000-memory.dmp

        Filesize

        104KB

      • memory/2660-109-0x0000000004860000-0x000000000486C000-memory.dmp

        Filesize

        48KB

      • memory/2660-110-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2660-22-0x00000000003D0000-0x00000000003EA000-memory.dmp

        Filesize

        104KB

      • memory/2680-38-0x00000000003C0000-0x00000000003DA000-memory.dmp

        Filesize

        104KB

      • memory/2680-39-0x00000000003C0000-0x00000000003DA000-memory.dmp

        Filesize

        104KB

      • memory/2680-170-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2680-24-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2680-185-0x00000000003C0000-0x00000000003DA000-memory.dmp

        Filesize

        104KB

      • memory/2880-108-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2924-93-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2924-92-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB