Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 14:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe
-
Size
448KB
-
MD5
41cddb92c40e1603cdd00456cf19b1b8
-
SHA1
c55741e0e2068f8f2c1f920822335ecf2816a17e
-
SHA256
fdadd323f4e3b7dfa61822fb9abe621a9dc0b79f465c8b767cee4f5ecf4bb194
-
SHA512
fcb9110cc2c6e469079c400ab2f2a7cd55c92011fcdcc7a38a4fb483489a2ac642e097bf9099a94063b4ff5e7450116f2ac581292f1b81a252731d6181a902d0
-
SSDEEP
6144:wQN9opCq9B2U1NZx9WRpRnbcE96n6+mpv2muhHklc37k8ztMj/+pLp:5opCQ4YWRnYE06+0BumlmkvzCp
Score
10/10
Malware Config
Extracted
Family
netwire
C2
top.westover.xyz:4590
Attributes
-
activex_autorun
true
-
activex_key
{803GTO4N-ENS6-08FV-IL8I-U12VW8O81OU2}
-
copy_executable
false
-
delete_original
false
-
host_id
ACALYS-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
WDqjVsjL
-
offline_keylogger
true
-
password
252522
-
registry_autorun
true
-
startup_name
printer
-
use_mutex
true
Signatures
-
NetWire RAT payload 2 IoCs
resource yara_rule behavioral1/memory/1284-8-0x0000000048D70000-0x0000000048DE2000-memory.dmp netwire behavioral1/memory/1284-10-0x0000000048D70000-0x0000000048DE2000-memory.dmp netwire -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{803GTO4N-ENS6-08FV-IL8I-U12VW8O81OU2} 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{803GTO4N-ENS6-08FV-IL8I-U12VW8O81OU2}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe\"" 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\printer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe" 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1284 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe"1⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1284