Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

70d0bd7633...18.exe

windows7-x64

7

70d0bd7633...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    23/10/2024, 21:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    70d0bd7633d10c492839272c97b2544e_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    70d0bd7633d10c492839272c97b2544e

  • SHA1

    4da0e8c2fe1f06b13985d700fe15686a1015c3bb

  • SHA256

    6472de894c5cb6050fd80cdd893b8772aef71f8bdb5c65a0175cf7cbb90e6ec6

  • SHA512

    99d43ed2060eb6371a54f73af407fe4cc7644a93e5f856419ad0cb8769b2664139cb9097ff4be4b8dbb93f2c5da4fc90bc48eeac6fe0b3df5f8bc12428b5b5b2

  • SSDEEP

    24576:91OYdaPtyx5f3bpaOZpBr8Mok3CwAvCJYNsO7z7YHgEzmvDjvANu29N:91Os1gOpBrRokSwAqJY73Sz2Qv

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\70d0bd7633d10c492839272c97b2544e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\70d0bd7633d10c492839272c97b2544e_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Users\Admin\AppData\Local\Temp\7zSBECD.tmp\setup.exe
      .\setup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\7zSBECD.tmp\PatchCleaner.msi"
        3⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2076
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 57B21C53F8B1C6B2A3E120314752295F C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3032
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding AD85A127CC243C1BDDE98E03D4C2C922
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2136
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:2508
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005DC" "00000000000003A4"
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:584

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\f773af0.rbs
      Filesize

      12KB

      MD5

      fa0581dc9b0b0f1e5e191ed5a424b0cc

      SHA1

      922c917c1ab9ca425f0a49913baf3d51286917ca

      SHA256

      317021b9e271bb0c869c170e1415676b9d8f69ab597d965283e685fa1d7279a6

      SHA512

      a3a8d7df328998ebe21c1acd06a5b87d13860cdb3edacfbb373855b1c5ab775f4a8f62e2ea91b56a6f65e21bd10de74ad76226d80396bc821e07a7ae1dcc3261

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zSBECD.tmp\PatchCleaner.msi
      Filesize

      2.0MB

      MD5

      ca19dc264e480db621d11429e08ca62b

      SHA1

      732fa43146301e30c7dfbb700081691ddb4e28c7

      SHA256

      c43f57c1aff7a3571fb89a6467247417bdf5b5ae2cd3ab60ce444490bc4df164

      SHA512

      af419f36fa581d6fb1cbfb6f598283c1a9a4e3315e19d227cb4806e3de7b929b400913ca3f09e5c3c58646907b363ebf2cf282610d54ac507a3d66eaf71b1a71

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Cab3B5B.tmp
      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIC13F.tmp
      Filesize

      305KB

      MD5

      79a1dc3e058699630f44eaef8736d637

      SHA1

      cdaa694b65dd49d726e2ef676749351adf97165a

      SHA256

      adf737e044c8125286b7f0c2907597d840ca6f3dc92e8cb56a5bc20243c723d4

      SHA512

      16db5d41c07e568c7cba18d5dc2cf2f566b0f1059256574cec69b00796850fc2e5a8c12e5b27e0547817b204db5a9532f893f42ab4f3c5c165a2e654e17a0605

      Download Submit

    • C:\Windows\Installer\{727DA176-50BB-452C-8DB5-96EE0A573ED4}\_9C79D8932B8391D44D5ECB.exe
      Filesize

      184KB

      MD5

      37831340b21b0e54552139628fe6d9c7

      SHA1

      455ce35b74be73487e494f5f87812fb5db4f93a6

      SHA256

      962011dd08a688f53d4b9e4f2574ce330f1f2b317e96ef5bf1a808b8ecd8bb34

      SHA512

      b5723a24142dfc2e2a6d7f7dc1533ee3d769c1cd0db9665671f9538406350ec8c7cc4afb30408aa66391baf27c7ad9586a8dafdbefc28a1d28549ff84c6d36d8

      Download Submit

    • \Users\Admin\AppData\Local\Temp\7zSBECD.tmp\setup.exe
      Filesize

      772KB

      MD5

      fb3fdbb47f9b738a64f8a874247ad219

      SHA1

      2103c9ffd7f5af42f5e0e3a929ff59f61b9e4eab

      SHA256

      e1c84c55cd245d0b487cfc816676c13729c53cb8f0462d955dd6a39219053c62

      SHA512

      bd82b76fa95730cfa2fd3e833a9b1a65f5c27b0d348d26e245c57f15d34a3ff2988cf19625d0351cd0fa7f56bca372085092394397f7d3a19d5ad6cae428a57c

      Download Submit