Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

70d0bd7633...18.exe

windows7-x64

7

70d0bd7633...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2024, 21:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    70d0bd7633d10c492839272c97b2544e_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    70d0bd7633d10c492839272c97b2544e

  • SHA1

    4da0e8c2fe1f06b13985d700fe15686a1015c3bb

  • SHA256

    6472de894c5cb6050fd80cdd893b8772aef71f8bdb5c65a0175cf7cbb90e6ec6

  • SHA512

    99d43ed2060eb6371a54f73af407fe4cc7644a93e5f856419ad0cb8769b2664139cb9097ff4be4b8dbb93f2c5da4fc90bc48eeac6fe0b3df5f8bc12428b5b5b2

  • SSDEEP

    24576:91OYdaPtyx5f3bpaOZpBr8Mok3CwAvCJYNsO7z7YHgEzmvDjvANu29N:91Os1gOpBrRokSwAqJY73Sz2Qv

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\70d0bd7633d10c492839272c97b2544e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\70d0bd7633d10c492839272c97b2544e_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Users\Admin\AppData\Local\Temp\7zSA22B.tmp\setup.exe
      .\setup.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:916
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\7zSA22B.tmp\PatchCleaner.msi"
        3⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2724
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 8C4032444C6D0158C3E135F24F7F9170 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4156
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:692
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding E008D6FE8302D5FCBE1AA319F99A205A
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3760
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4976

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e583cc7.rbs
      Filesize

      13KB

      MD5

      19a38c919bbce8a84d1fc0d258585a86

      SHA1

      511dc85363339338feb5891a420eafe9cab771f5

      SHA256

      8d7e23f90a96e37f3aadc92ed3aad1097756b4c2fa51660489cf6cbdfd413247

      SHA512

      423958f8c579b9ec1b0b226303232ed8297dd5de6e8f47b402e5b97b17d6e27de31b953ec7c675a375dfcb56c1a128878cfb6e37af3d294e619970fcb2fce545

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zSA22B.tmp\PatchCleaner.msi
      Filesize

      2.0MB

      MD5

      ca19dc264e480db621d11429e08ca62b

      SHA1

      732fa43146301e30c7dfbb700081691ddb4e28c7

      SHA256

      c43f57c1aff7a3571fb89a6467247417bdf5b5ae2cd3ab60ce444490bc4df164

      SHA512

      af419f36fa581d6fb1cbfb6f598283c1a9a4e3315e19d227cb4806e3de7b929b400913ca3f09e5c3c58646907b363ebf2cf282610d54ac507a3d66eaf71b1a71

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zSA22B.tmp\setup.exe
      Filesize

      772KB

      MD5

      fb3fdbb47f9b738a64f8a874247ad219

      SHA1

      2103c9ffd7f5af42f5e0e3a929ff59f61b9e4eab

      SHA256

      e1c84c55cd245d0b487cfc816676c13729c53cb8f0462d955dd6a39219053c62

      SHA512

      bd82b76fa95730cfa2fd3e833a9b1a65f5c27b0d348d26e245c57f15d34a3ff2988cf19625d0351cd0fa7f56bca372085092394397f7d3a19d5ad6cae428a57c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIA70D.tmp
      Filesize

      305KB

      MD5

      79a1dc3e058699630f44eaef8736d637

      SHA1

      cdaa694b65dd49d726e2ef676749351adf97165a

      SHA256

      adf737e044c8125286b7f0c2907597d840ca6f3dc92e8cb56a5bc20243c723d4

      SHA512

      16db5d41c07e568c7cba18d5dc2cf2f566b0f1059256574cec69b00796850fc2e5a8c12e5b27e0547817b204db5a9532f893f42ab4f3c5c165a2e654e17a0605

      Download Submit

    • C:\Windows\Installer\{727DA176-50BB-452C-8DB5-96EE0A573ED4}\_9C79D8932B8391D44D5ECB.exe
      Filesize

      184KB

      MD5

      37831340b21b0e54552139628fe6d9c7

      SHA1

      455ce35b74be73487e494f5f87812fb5db4f93a6

      SHA256

      962011dd08a688f53d4b9e4f2574ce330f1f2b317e96ef5bf1a808b8ecd8bb34

      SHA512

      b5723a24142dfc2e2a6d7f7dc1533ee3d769c1cd0db9665671f9538406350ec8c7cc4afb30408aa66391baf27c7ad9586a8dafdbefc28a1d28549ff84c6d36d8

      Download Submit

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Filesize

      24.1MB

      MD5

      31379eaac886112bb03d3d89ff2dc067

      SHA1

      57f743f051dac735ba218debff663faef466bda4

      SHA256

      e9e0d96795dec63e73b4f3161cd1c2025dd9e611d4cbd28bc98580b59fcaf8be

      SHA512

      139ca6b04109e287a1960f95ffc67360bae835d8420cfd718b6c28f4c5ac87ea12ba68b780e9fcab422bf2418ce6ebd7ac36047a68eac838fec16c708adf7677

      Download Submit

    • \??\Volume{ff55cfe6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8b27acbf-2b8b-4c74-b9a6-59c2c495fcf1}_OnDiskSnapshotProp
      Filesize

      6KB

      MD5

      45e2fe299d6cca12bd522958f35ef70d

      SHA1

      777eaa6e52c842c1d0b4257589eed620035f67b2

      SHA256

      cafdc1af5722cb35b4824312df1d5f6f2a40d52d0cebb6fcea0b96b97f1e3fc1

      SHA512

      a261891e71616ea6836bae26522df37fd86a905478bd2c86da9c4c3b8bb4454bca98c8cfc5f0ddaecf0ad32d85ea902762bc0848e4c7cc80644ed7bcbc82c575

      Download Submit