Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    27/10/2024, 22:53

General

  • Target

    765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe

  • Size

    255KB

  • MD5

    765c05d132fc95c861fdfa284e1d6a8c

  • SHA1

    cb8da150dc321326e7affffdcca2860cf059413b

  • SHA256

    09dcac07347dfd28950539b6e5a97063ffd1a5b5798d341c560a8129813e931a

  • SHA512

    4ad673d503c4ac62ac591412da62f0c20837baf04b874cdbc8b5ab497da7b3a8933569510d9f3f1cbb7fe649c1d87f5ec6a9230194aa6470df08f93b2c2d7c0f

  • SSDEEP

    6144:h1OgDPdkBAFZWjadD4s5c4PPvGUYS3/Hibu:h1OgLdaOcmvjHibu

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 4 IoCs
  • Modifies registry class 45 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe
      .\51e8e611a83cb.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • System policy modification
      PID:2912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\saffe saevue\uninstall.exe

    Filesize

    48KB

    MD5

    f3c79bda3fdf7c5dd24d60400a57cadb

    SHA1

    1adb606aaeedb246a371c8877c737f0f8c798625

    SHA256

    a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

    SHA512

    c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

  • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a8404.dll

    Filesize

    116KB

    MD5

    05234975b085632d70d89c2f420c5107

    SHA1

    078fb2a3e5de54c3737a4541242a4725c02c6b9c

    SHA256

    a758ad4fdc8949ea005258075457a972eb0672d69d98d688117b85221fca096a

    SHA512

    f9fa6aee142e32875127feadebbe235f4f376b0c3b7415036b8afc81c0a09a8ba0c5ec9e1703f1a34b220b7646caa1ca02629918185c4afbafe6926014044c4e

  • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a8404.tlb

    Filesize

    18KB

    MD5

    c1e296ff01d3cf37f91c7473bdd9de52

    SHA1

    832e3d1ddeb5a0ceb5b13c1ee271eb94bf9bf2a6

    SHA256

    a8e54ad3e1fbc91d5a7b02bf177a24a02f2558419ce46859bf15859b81478492

    SHA512

    aeb1f3962746caa3858c27b4753959d5ec9db2727e94642d5db2710633a96e7ceef5f9c0ff3b358f83143b6594459b5d9a94e095fed7a5d1fa97ae6a3c4e564c

  • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\51e8e611a81e17.02675710.js

    Filesize

    4KB

    MD5

    39e5e68719f07e9a0c2c600b25ac4377

    SHA1

    42f0571a3180f1d36a0829bb84decec5190c9421

    SHA256

    4f93b69b45bf73e1e58debd2a787d1d38b92c1fa3beff632d41445fc342d27b3

    SHA512

    866915a506851b19105f2f5db1b90411359201450b1a86fb68bd4730695d0db110b90c48c32784649fe06247a09dd845b0dceda9a9d38030ce08af83c2552c94

  • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\background.html

    Filesize

    161B

    MD5

    dc3ac91dddc699fb9092ee7d06d12287

    SHA1

    4359590d8562c8315d000805b171b691033ad51e

    SHA256

    14711b58731ee8ed01a251bbd179ebb5ea65dcf84a0ba8b3ff2d747aa0ff28db

    SHA512

    851f7715d70f291ecb7b2a0cbfb94a35cd0f8e309e8b4aff97243afcff4ea1b89e898d336f5fe7510002569c3bf82c809a2be194cc22bbb519e422ad0b807ef6

  • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\content.js

    Filesize

    197B

    MD5

    5f9891607f65f433b0690bae7088b2c1

    SHA1

    b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

    SHA256

    fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

    SHA512

    76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

  • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\lsdb.js

    Filesize

    559B

    MD5

    209b7ae0b6d8c3f9687c979d03b08089

    SHA1

    6449f8bff917115eef4e7488fae61942a869200f

    SHA256

    e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

    SHA512

    1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

  • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\manifest.json

    Filesize

    504B

    MD5

    e74a293de62fd297f21536a7f30b92eb

    SHA1

    7840f24e31050f8fbbd12bbaff11699ca45ae526

    SHA256

    34246e56e28f5a391aa7f64bb74611667a7265146ee92b5a905cd380226326c0

    SHA512

    5de49d74d74bf8c5c6d29a8b294a8e0b2c948f0b8683b00fbe7ce1b7f6cce22005c4c333680e6f975e830496a3cddc0e27585cc33f4085a8a62f9280de4d8221

  • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\sqlite.js

    Filesize

    1KB

    MD5

    c43c5a3c2f9ace3f85d58942f414a998

    SHA1

    ef2309d0dfd886f03053d656aea1cf398e2a595e

    SHA256

    f1e9ce4a4acacb7dbea1bc93ab0a4ffe625f858511890b60c5e2996ad826bf99

    SHA512

    2deb31cd5e7c73f1a9b5809b1c22ab9b39fef297853597682d63008b4723d137e99b3e0895f7d7a9e487b059de21d3789839ab9266eac8e73c7bab52550bc69c

  • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\settings.ini

    Filesize

    6KB

    MD5

    140ff6ea77927ed5eac49cf96fa4c5b0

    SHA1

    820e2e22390419845b359a9d52b6c7162bfc8fdb

    SHA256

    d7d7db8ede6fba8c7456b5ef3ca2678d5802ecdc7e3d772c38187a4023e1b848

    SHA512

    98331f40439d5ed6c75e425b3ff109805b0524eb4843f09a2479958be5649f70f2a0664326bb469a8073ef5cc68542f08bbcf41b6b7e7ce2b33d200d45ebc8ad

  • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    ab4383ac993b4fb6575c772f218e3f09

    SHA1

    96290924add5f885c018d6746d05c65e9a56f1f4

    SHA256

    7c9200c7c223d32a10c4240e1a88bf868776c1a739cd35621107daba8b2ae1ff

    SHA512

    ca7e3e490d8d8fa5d4b640bb2a09e65155a0826b12c5363dab8bb587d6a9b9832821c7f3a9fc15b722f1ed07b79e331bc06fc0dd3fc1e43c7ced7c016353587c

  • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\[email protected]\chrome.manifest

    Filesize

    116B

    MD5

    daf5263cfd9bbaecb562b23ecc745fdb

    SHA1

    7c81cceaa807d2550a80e390c5869b1f25ccd248

    SHA256

    4ee519aaa98db6dc6b7e3c11d418a4bda63f86345dedfcf05dc3cc9e4487da70

    SHA512

    0bb6e0a63b214415f96b7aae2af8199877f9d55e5cbac3cde2f7575f8935e929be0cd144c6fd90a7b774aa11bbef79a5f39d54b4f310c1a6bcabdae682d6f71b

  • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\[email protected]\content\bg.js

    Filesize

    8KB

    MD5

    084aec693fa093b650bd650d2213028b

    SHA1

    16a160ef8371ba5698c315d0bd6e3dea9da3c47c

    SHA256

    bb4e16e1b5fbac58ae4565ae9a81abcc1a598bd6a5d0ee5730d3ac817e69e61f

    SHA512

    2c53b3f8a4be5162c0f88674f2ea1b7ae22cff80bbd13354c47131d685595ce7ebd7d2cc378e6dc1beee2e4124105ef401f690e7d33f540246e8c043295d1c79

  • C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\[email protected]\install.rdf

    Filesize

    602B

    MD5

    6485a09518209dc955e9b81dcc7e7b3d

    SHA1

    a15d64938220566a031eea2692d02612b5ad0360

    SHA256

    53f6f2d2c7ebda06fedc9342beb69fc9c6798bc301406d3e7b2cc82ab2afb75b

    SHA512

    61b8564c52bc7c01a7a2567a97a72651408f15a4c63cad3464407e60df0a8db51c20dbee65892e5cda8b1ef28c63aa84f94f1d9ee7371512a5e8dacc38d80868

  • \Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe

    Filesize

    71KB

    MD5

    b78633fae8aaf5f7e99e9c736f44f9c5

    SHA1

    26fc60e29c459891ac0909470ac6c61a1eca1544

    SHA256

    d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

    SHA512

    3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

  • \Users\Admin\AppData\Local\Temp\nsz5C16.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    7579ade7ae1747a31960a228ce02e666

    SHA1

    8ec8571a296737e819dcf86353a43fcf8ec63351

    SHA256

    564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    SHA512

    a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

  • \Users\Admin\AppData\Local\Temp\nsz5C16.tmp\nsJSON.dll

    Filesize

    7KB

    MD5

    b9cd1b0fd3af89892348e5cc3108dce7

    SHA1

    f7bc59bf631303facfc970c0da67a73568e1dca6

    SHA256

    49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

    SHA512

    fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

  • memory/2912-76-0x0000000075270000-0x000000007527A000-memory.dmp

    Filesize

    40KB