Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    17/04/2024, 18:55

General

  • Target

    f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe

  • Size

    409KB

  • MD5

    f672d1603b04f6a1bb2c1168429768de

  • SHA1

    7321c9d98b08b4e2a59240666a17787d583e74f0

  • SHA256

    d267c57b4520dcb86c9930857aef0d59457c832b820a3a4c568c63ffe2837165

  • SHA512

    21bff6aea5afa8f983ce920f8d0b4774173ccd065dd44f01e03d31fba5bb706c6e1b7cc6e5ef4394724e539f2c4842ee13f64e182dae72a700ef08d9f33e6575

  • SSDEEP

    12288:L2LfajrFOnz+EtLLz7YVWy+OPWejt/pTwQqXPU:L2Lmw+EtYVR1Fjt/pTwQqs

Malware Config

Extracted

Family

warzonerat

C2

111.90.146.200:5200

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 12 IoCs
  • Drops startup file 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\system32\notepad.exe"
      2⤵
      • Drops startup file
      PID:2296
    • C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Adds Run key to start application
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:2376
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Add-MpPreference -ExclusionPath C:\
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2600
      • C:\ProgramData\images.exe
        "C:\ProgramData\images.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Windows\SysWOW64\notepad.exe
          "C:\Windows\system32\notepad.exe"
          4⤵
            PID:2808
          • C:\ProgramData\images.exe
            "C:\ProgramData\images.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2152
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell Add-MpPreference -ExclusionPath C:\
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2428
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe"
              5⤵
                PID:1248
            • C:\ProgramData\images.exe
              "C:\ProgramData\images.exe" 2 2152 259399226
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:2516
        • C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe" 2 2376 259397074
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2004
          • C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2720
            • C:\Windows\SysWOW64\notepad.exe
              "C:\Windows\system32\notepad.exe"
              4⤵
              • Drops startup file
              PID:2620
            • C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"
              4⤵
                PID:2472
              • C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe" 2 2472 259399460
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3004
                • C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
                  "C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2440
                  • C:\Windows\SysWOW64\notepad.exe
                    "C:\Windows\system32\notepad.exe"
                    6⤵
                      PID:1632

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

            Filesize

            7KB

            MD5

            9f682defdaeed1a680601c7ee29e98be

            SHA1

            d3fce83f2a61eedb5e7679f95d36d2a501fa7c4a

            SHA256

            ecd123794bb41e2129d7d9af51129ae745556a231ed9116c7654b623d6d3066f

            SHA512

            356b05e037b0c73fa1fcc9087190f54a2a2f33268f81e7648c0af3021a408a846515e089f48acc180d59e16825d6e08334bf2b1f212899f16ac39b8bb69a7032

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs

            Filesize

            158B

            MD5

            3cccf9435b659bf318d80f780097ffbf

            SHA1

            f0af7b20ad3498befcc19d90c0c1c7d4f021e77f

            SHA256

            a5c69769ed69652017de0ac5b2b49978af9580a67f0ce473742fc3a04c00a86a

            SHA512

            d28c78ce84c518b8446aaa2b10bced63c7877b969abdcc0d3b65251123c1472f66598935de7facab9f5608c2bdc01b03156b00413687ee40b272c1b307e29b40

          • \ProgramData\images.exe

            Filesize

            409KB

            MD5

            f672d1603b04f6a1bb2c1168429768de

            SHA1

            7321c9d98b08b4e2a59240666a17787d583e74f0

            SHA256

            d267c57b4520dcb86c9930857aef0d59457c832b820a3a4c568c63ffe2837165

            SHA512

            21bff6aea5afa8f983ce920f8d0b4774173ccd065dd44f01e03d31fba5bb706c6e1b7cc6e5ef4394724e539f2c4842ee13f64e182dae72a700ef08d9f33e6575

          • memory/1248-104-0x0000000000160000-0x0000000000161000-memory.dmp

            Filesize

            4KB

          • memory/2004-17-0x0000000000350000-0x0000000000351000-memory.dmp

            Filesize

            4KB

          • memory/2004-39-0x0000000001E20000-0x0000000001EF5000-memory.dmp

            Filesize

            852KB

          • memory/2004-11-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2004-15-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2004-16-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2004-14-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

          • memory/2152-63-0x0000000000400000-0x0000000000553000-memory.dmp

            Filesize

            1.3MB

          • memory/2152-71-0x0000000000400000-0x0000000000553000-memory.dmp

            Filesize

            1.3MB

          • memory/2152-107-0x0000000000400000-0x0000000000553000-memory.dmp

            Filesize

            1.3MB

          • memory/2296-5-0x0000000000080000-0x0000000000081000-memory.dmp

            Filesize

            4KB

          • memory/2296-13-0x0000000000080000-0x0000000000081000-memory.dmp

            Filesize

            4KB

          • memory/2376-19-0x0000000000400000-0x0000000000553000-memory.dmp

            Filesize

            1.3MB

          • memory/2376-34-0x0000000000400000-0x0000000000553000-memory.dmp

            Filesize

            1.3MB

          • memory/2376-35-0x0000000002C50000-0x0000000002D25000-memory.dmp

            Filesize

            852KB

          • memory/2376-18-0x0000000000400000-0x0000000000553000-memory.dmp

            Filesize

            1.3MB

          • memory/2376-7-0x0000000000400000-0x0000000000553000-memory.dmp

            Filesize

            1.3MB

          • memory/2416-4-0x0000000000540000-0x0000000000541000-memory.dmp

            Filesize

            4KB

          • memory/2416-3-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2416-0-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2416-9-0x0000000002130000-0x0000000002205000-memory.dmp

            Filesize

            852KB

          • memory/2416-1-0x0000000000230000-0x0000000000231000-memory.dmp

            Filesize

            4KB

          • memory/2416-2-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2428-101-0x0000000002B00000-0x0000000002B40000-memory.dmp

            Filesize

            256KB

          • memory/2428-100-0x00000000742F0000-0x000000007489B000-memory.dmp

            Filesize

            5.7MB

          • memory/2428-102-0x00000000742F0000-0x000000007489B000-memory.dmp

            Filesize

            5.7MB

          • memory/2428-98-0x00000000742F0000-0x000000007489B000-memory.dmp

            Filesize

            5.7MB

          • memory/2428-99-0x0000000002B00000-0x0000000002B40000-memory.dmp

            Filesize

            256KB

          • memory/2440-90-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2440-88-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2440-87-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2440-92-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2472-84-0x0000000000400000-0x0000000000553000-memory.dmp

            Filesize

            1.3MB

          • memory/2472-78-0x0000000000400000-0x0000000000553000-memory.dmp

            Filesize

            1.3MB

          • memory/2516-68-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2516-65-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/2516-74-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2516-77-0x00000000002A0000-0x00000000002A1000-memory.dmp

            Filesize

            4KB

          • memory/2600-76-0x0000000074270000-0x000000007481B000-memory.dmp

            Filesize

            5.7MB

          • memory/2600-83-0x0000000074270000-0x000000007481B000-memory.dmp

            Filesize

            5.7MB

          • memory/2600-80-0x0000000002AF0000-0x0000000002B30000-memory.dmp

            Filesize

            256KB

          • memory/2600-75-0x0000000002AF0000-0x0000000002B30000-memory.dmp

            Filesize

            256KB

          • memory/2600-73-0x0000000074270000-0x000000007481B000-memory.dmp

            Filesize

            5.7MB

          • memory/2600-79-0x0000000002AF0000-0x0000000002B30000-memory.dmp

            Filesize

            256KB

          • memory/2720-44-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2720-40-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2720-70-0x00000000031B0000-0x0000000003285000-memory.dmp

            Filesize

            852KB

          • memory/2720-59-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2720-50-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

          • memory/2720-54-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2876-41-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2876-37-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/2876-42-0x00000000003A0000-0x00000000003A1000-memory.dmp

            Filesize

            4KB

          • memory/2876-47-0x00000000004F0000-0x00000000004F1000-memory.dmp

            Filesize

            4KB

          • memory/2876-46-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/3004-82-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/3004-72-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB

          • memory/3004-81-0x0000000000400000-0x00000000004D5000-memory.dmp

            Filesize

            852KB