Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 05:04

General

  • Target

    0e0dde4655443c471644fdf4531d04bd_JaffaCakes118.dll

  • Size

    224KB

  • MD5

    0e0dde4655443c471644fdf4531d04bd

  • SHA1

    a7395cb1ac51a984d8e9a964675066092e906bab

  • SHA256

    441ca92a744fb75046b8e077dd7801e5619a96446ec64690cff9f7e00bc772a8

  • SHA512

    345480e127e66fac11256604ab65911978ef44f441860d8e3f58f9b97c8b916cf239efcf8362499f5d574055527241bda34c37ded9ab8fea8eebe8344fe8f499

  • SSDEEP

    3072:/FrGb+Qm+ozhCUrMKzh0Uh2o8ELiYcnQrsIze+08Fx+z+uTei/2GRnMtn9Evv+:Iozh0Uoo8ELiznoe38c+Ni/2mnMkvG

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e0dde4655443c471644fdf4531d04bd_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e0dde4655443c471644fdf4531d04bd_JaffaCakes118.dll,#1
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\PROGRA~3\lsass.exe
        C:\PROGRA~3\lsass.exe C:\Users\Admin\AppData\Local\Temp\0e0dde4655443c471644fdf4531d04bd_JaffaCakes118.dll,GOF1
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2236
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:17410 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\lsass.exe

    Filesize

    60KB

    MD5

    889b99c52a60dd49227c5e485a016679

    SHA1

    8fa889e456aa646a4d0a4349977430ce5fa5e2d7

    SHA256

    6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

    SHA512

    08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    823fe1de5451b6ea9c69599b131233db

    SHA1

    af8b9b46bbe4b0b996abc996cc5f000f8c498348

    SHA256

    a13b5fcb02fe68cd72e236cec1284e80ef9aa37bcbb596f57fa0d32f9bdb5a32

    SHA512

    043c555804f19aa482e5419fd0a27b3cf3ca5369cf4f9941608358a7cca8f524515041881b35af63b02dd915abca4a51f45c2b60f1070a293b652d6fbe3ca782

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    e07d9afd313e729a0e8cca5fed626e4c

    SHA1

    c0510796498e0e2cf30515a34e5f4f3e0a2f1765

    SHA256

    64509dd74c4471fb6387ff7b748e320d2400b15098435a3e71a07d45cc1ace4a

    SHA512

    7a4ab30a24449af732639e47eed87a49c5e2ed5b81e164b941276a610fd9eec318d69967286f16ae201906579866c09d2ca4a5de4403d7aa2a1991d26671eaac

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver145E.tmp

    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JACP9GNT\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • memory/2188-1-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2188-0-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/2604-21-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-6-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-44-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-22-0x0000000002940000-0x0000000002941000-memory.dmp

    Filesize

    4KB

  • memory/2604-100-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-122-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-143-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-66-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-176-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-197-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-216-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-238-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-259-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-281-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-302-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB

  • memory/2604-324-0x0000000010000000-0x000000001008D000-memory.dmp

    Filesize

    564KB