Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 07:04

General

  • Target

    3e461488855f65ceefe255faf340def7_JaffaCakes118.exe

  • Size

    252KB

  • MD5

    3e461488855f65ceefe255faf340def7

  • SHA1

    e517091c4a1565fec8c91b014baa94fa11561650

  • SHA256

    c6af2f075148a6c62a0e389f293dfb04d3e5d5c0e8280431e3f9ff3e940bde8e

  • SHA512

    8f397b8c27bd7e45f0e6cc7a7cfd1af9ceccffb0b2c06c40869e14c4342d475ef9549a433446ac4587956a08bfab61c4a85d5379c8816350271ae71c7795e23e

  • SSDEEP

    6144:oE56P/i5P4dNtURdebDT122lgQ5mG9fR:p5UKcNtcS5mG9

Malware Config

Extracted

Family

netwire

C2

info1.nowddns.com:5552

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    NOW-DNS-5552

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    gqmQdKHu

  • offline_keylogger

    true

  • password

    caster123

  • registry_autorun

    false

  • use_mutex

    true

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • NetWire RAT payload 7 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e461488855f65ceefe255faf340def7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3e461488855f65ceefe255faf340def7_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Users\Admin\AppData\Local\Temp\3e461488855f65ceefe255faf340def7_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3e461488855f65ceefe255faf340def7_JaffaCakes118.exe"
      2⤵
        PID:1008

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1008-8-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/1008-7-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/1008-20-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/1008-5-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/1008-13-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/1008-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1008-16-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/1008-10-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/1008-17-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/1008-9-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/1008-6-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2364-0-0x0000000074611000-0x0000000074612000-memory.dmp

      Filesize

      4KB

    • memory/2364-1-0x0000000074610000-0x0000000074BBB000-memory.dmp

      Filesize

      5.7MB

    • memory/2364-18-0x0000000074610000-0x0000000074BBB000-memory.dmp

      Filesize

      5.7MB

    • memory/2364-19-0x0000000074610000-0x0000000074BBB000-memory.dmp

      Filesize

      5.7MB

    • memory/2364-2-0x0000000074610000-0x0000000074BBB000-memory.dmp

      Filesize

      5.7MB