Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    17/04/2024, 20:20

General

  • Target

    f696ead7eba6d5df7a2016b5fd193e9e_JaffaCakes118.exe

  • Size

    792KB

  • MD5

    f696ead7eba6d5df7a2016b5fd193e9e

  • SHA1

    3cf4cf17c5c2347721570f1df0d710133fb65413

  • SHA256

    d1503ceac0fde6e0979d6ba3f6fba34ebdc3fb4ca5f785757e8ef45383b9273d

  • SHA512

    1013c7405fca15e1c8759ff049de21cfa85aeb3ba15294690b396b6fb165648d10868efc86b9c84a458617a5444c769e2ca86cc600de58b98a97abb620d44073

  • SSDEEP

    12288:UPWID8VeuWJO7G/LWmHut5CqDm1kBB4XIMF9GHsoY+K2NeJ/b/XaO8gWSFK+pJSC:UuID8moGTJQ5xn4XIdM+KK4jiT0FK+p

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 5 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f696ead7eba6d5df7a2016b5fd193e9e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f696ead7eba6d5df7a2016b5fd193e9e_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Users\Admin\AppData\Local\Temp\f696ead7eba6d5df7a2016b5fd193e9e_JaffaCakes118.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        dw20.exe -x -s 580
        3⤵
          PID:2436

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2436-24-0x0000000000750000-0x0000000000751000-memory.dmp

      Filesize

      4KB

    • memory/2516-23-0x0000000074110000-0x00000000746BB000-memory.dmp

      Filesize

      5.7MB

    • memory/2516-22-0x00000000004A0000-0x00000000004E0000-memory.dmp

      Filesize

      256KB

    • memory/2516-25-0x0000000074110000-0x00000000746BB000-memory.dmp

      Filesize

      5.7MB

    • memory/2516-15-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

    • memory/2516-5-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

    • memory/2516-7-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

    • memory/2516-9-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

    • memory/2516-11-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

    • memory/2516-18-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

    • memory/2516-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2516-20-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

    • memory/2516-21-0x0000000074110000-0x00000000746BB000-memory.dmp

      Filesize

      5.7MB

    • memory/2908-0-0x0000000074190000-0x000000007473B000-memory.dmp

      Filesize

      5.7MB

    • memory/2908-2-0x0000000074190000-0x000000007473B000-memory.dmp

      Filesize

      5.7MB

    • memory/2908-17-0x0000000074190000-0x000000007473B000-memory.dmp

      Filesize

      5.7MB

    • memory/2908-3-0x0000000074190000-0x000000007473B000-memory.dmp

      Filesize

      5.7MB

    • memory/2908-1-0x0000000000790000-0x00000000007D0000-memory.dmp

      Filesize

      256KB

    • memory/2908-4-0x0000000000790000-0x00000000007D0000-memory.dmp

      Filesize

      256KB