Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2024, 05:10

General

  • Target

    1aeafb4aeda2e03af35db00806c4a752_JaffaCakes118.exe

  • Size

    534KB

  • MD5

    1aeafb4aeda2e03af35db00806c4a752

  • SHA1

    dd0a5862ffbccc7949e8fd6407ef4ee717ba4aac

  • SHA256

    cc29af4836750180f2e29745658cf1fd45302c2dc48c952cf38835370932a6f8

  • SHA512

    a797b0514d2325f4641d1aca542b2fa6d92f1ef71882f549ba0cc33c48ebc392d72787b4cf63a336c4a4220a47d06b2fe260f157b3d2f4346c7c54472f0edcb9

  • SSDEEP

    6144:ZbuodmSEjapEQaFd8M6rjiiiJUWWAxlp4HqUhiNAyV31RFp07k0rqQ8:MAHlaF6j2iiJUWfl27iKQRFp4kV

Score
10/10

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1aeafb4aeda2e03af35db00806c4a752_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1aeafb4aeda2e03af35db00806c4a752_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:2900
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
        3⤵
          PID:2608
      • C:\Users\Admin\AppData\Local\Temp\svhost.exe
        "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2552
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2448
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 300
          3⤵
          • Delays execution with timeout.exe
          PID:2180
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:1896

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat

        Filesize

        204B

        MD5

        bfcbf382f036462e63f307ca4ae280c7

        SHA1

        ffe98d15fa5ea205220d6bc105e317253a6ea003

        SHA256

        2c3dd84c3ce3e529117e611d8caf4fc7f5a902840350f4ca524c251a2152c727

        SHA512

        1b912652cc989541b396df5fd6bf207a4cf4ed891dc6e3223b8d0497c19a2589cb644c4c96ca01d882a7643f240c566966d84e46d77e9ad33e05214f8f553d16

      • \Users\Admin\AppData\Local\Temp\FolderN\name.exe

        Filesize

        534KB

        MD5

        1aeafb4aeda2e03af35db00806c4a752

        SHA1

        dd0a5862ffbccc7949e8fd6407ef4ee717ba4aac

        SHA256

        cc29af4836750180f2e29745658cf1fd45302c2dc48c952cf38835370932a6f8

        SHA512

        a797b0514d2325f4641d1aca542b2fa6d92f1ef71882f549ba0cc33c48ebc392d72787b4cf63a336c4a4220a47d06b2fe260f157b3d2f4346c7c54472f0edcb9

      • \Users\Admin\AppData\Local\Temp\svhost.exe

        Filesize

        85KB

        MD5

        2e5f1cf69f92392f8829fc9c9263ae9b

        SHA1

        97b9ca766bbbdaa8c9ec960dc41b598f7fad82a5

        SHA256

        51985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b

        SHA512

        f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883

      • memory/2552-28-0x0000000074F20000-0x00000000754CB000-memory.dmp

        Filesize

        5.7MB

      • memory/2552-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2552-13-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/2552-17-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/2552-29-0x0000000074F20000-0x00000000754CB000-memory.dmp

        Filesize

        5.7MB

      • memory/2552-44-0x0000000074F20000-0x00000000754CB000-memory.dmp

        Filesize

        5.7MB

      • memory/2552-27-0x0000000074F20000-0x00000000754CB000-memory.dmp

        Filesize

        5.7MB

      • memory/2552-23-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/2552-25-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/2552-20-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/2552-15-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/2552-16-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/2864-2-0x0000000074F20000-0x00000000754CB000-memory.dmp

        Filesize

        5.7MB

      • memory/2864-1-0x0000000074F20000-0x00000000754CB000-memory.dmp

        Filesize

        5.7MB

      • memory/2864-43-0x0000000074F20000-0x00000000754CB000-memory.dmp

        Filesize

        5.7MB

      • memory/2864-0-0x0000000074F21000-0x0000000074F22000-memory.dmp

        Filesize

        4KB