Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15/10/2024, 01:18
General
-
Target
451d8073e69e4ca14cba626553f24755_JaffaCakes118.exe
-
Size
2.8MB
-
MD5
451d8073e69e4ca14cba626553f24755
-
SHA1
2bd06aa070546ed780fda61f77875b7eff07ca6c
-
SHA256
655ec66ff682343e7688645d75ad2b5b1fb66057643a2ef851434db8e13ad5b1
-
SHA512
f1c1033acfc96f501ef7343ea6d0f4ba8fa694c2ce8ee671c83fc32da37794811209bcdd185440ea00ee7546e275a46083d7e1eabd1b6197dba64a4a9d917189
-
SSDEEP
24576:uMfmMfmMfmMfmMfmMfmMfmMfmMfmMfmMfmMfmMff:uffffffffffffa
Malware Config
Signatures
-
UAC bypass 3 TTPs 2 IoCs
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 31 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\451d8073e69e4ca14cba626553f24755_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\451d8073e69e4ca14cba626553f24755_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\mmmmmmmmm.exe"C:\Users\Admin\AppData\Local\Temp\mmmmmmmmm.exe"2⤵
- UAC bypass
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\mmmmmmmmm.exe" "mmmmmmmmm.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\SysWOW64\wscript.exe" "wscript.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\mmmmmmmmm.vbe"3⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD5451d8073e69e4ca14cba626553f24755
SHA12bd06aa070546ed780fda61f77875b7eff07ca6c
SHA256655ec66ff682343e7688645d75ad2b5b1fb66057643a2ef851434db8e13ad5b1
SHA512f1c1033acfc96f501ef7343ea6d0f4ba8fa694c2ce8ee671c83fc32da37794811209bcdd185440ea00ee7546e275a46083d7e1eabd1b6197dba64a4a9d917189
-
Filesize
54B
MD5ab0ec15dff055cadb7a2d3f53629d747
SHA143991dea301a1e892c1909d759a104382894947a
SHA2567631346fe22b7663d78f3e724298afaef37ad826656dc09708dbb5e76dca81f6
SHA512f5e0c107b6e669d43eb90b105e25b0f1d561096a6fc31e102730823e5ce5cb91694cd4880d691351d5548a6bbf1da6d8910f6b292222ae6a559c1863da29c8dd
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB