Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 18:50
Static task
static1
Behavioral task
behavioral1
Sample
afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe
-
Size
377KB
-
MD5
afdc3dc4e5703f404f366ff1595d5b60
-
SHA1
acbfd6eed4667adc74879f6d3b75147cff042c02
-
SHA256
48f79c0865a302403c6d29d9cde35cbdce9a3865780ca272ef2440968e709b7a
-
SHA512
2130db190d646593dc5258859061312742c83a2b21007601996ee8516990ff151140b4fbc82a9eab4fbf327996dd21eac8c0f4dd424b6f5cf3292df4a80f724c
-
SSDEEP
6144:ppjImruEl1fkUgYiv1PpTCfNfaPNA9aJ5928LZifuKTXqyid0cZtR:ppjIuu01fa30NSPCo2bF2y+TZtR
Malware Config
Extracted
trickbot
1000315
lib369
104.168.58.38:443
24.247.181.155:449
24.247.182.39:449
107.174.34.202:443
24.247.182.29:449
24.247.182.179:449
198.46.131.164:443
74.132.135.120:449
198.46.160.217:443
71.94.101.25:443
24.247.182.225:449
192.3.52.107:443
74.140.160.33:449
65.31.241.133:449
140.190.54.187:449
24.247.181.226:449
108.160.196.130:449
89.46.222.239:443
24.247.182.174:449
108.174.60.161:443
75.108.123.165:449
72.189.124.41:449
105.27.171.234:449
182.253.20.66:449
172.222.97.179:449
72.241.62.188:449
198.46.198.241:443
199.227.126.250:449
97.87.172.0:449
94.232.20.113:443
190.145.74.84:449
47.49.168.50:443
64.128.175.37:449
24.227.222.4:449
-
autorunControl:GetSystemInfoName:systeminfoName:injectDllName:pwgrab
Signatures
-
Trickbot x86 loader 4 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/3064-4-0x0000000000380000-0x00000000003C0000-memory.dmp trickbot_loader32 behavioral1/memory/3064-20-0x0000000000380000-0x00000000003C0000-memory.dmp trickbot_loader32 behavioral1/memory/2552-22-0x0000000000470000-0x00000000004B0000-memory.dmp trickbot_loader32 behavioral1/memory/2552-35-0x0000000000470000-0x00000000004B0000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 3024 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe -
Loads dropped DLL 2 IoCs
pid Process 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2716 sc.exe 1728 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 2736 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2736 powershell.exe Token: SeTcbPrivilege 3024 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2564 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 28 PID 3064 wrote to memory of 2564 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 28 PID 3064 wrote to memory of 2564 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 28 PID 3064 wrote to memory of 2564 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 28 PID 3064 wrote to memory of 2572 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 29 PID 3064 wrote to memory of 2572 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 29 PID 3064 wrote to memory of 2572 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 29 PID 3064 wrote to memory of 2572 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 29 PID 3064 wrote to memory of 2696 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 32 PID 3064 wrote to memory of 2696 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 32 PID 3064 wrote to memory of 2696 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 32 PID 3064 wrote to memory of 2696 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 32 PID 3064 wrote to memory of 2552 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 34 PID 3064 wrote to memory of 2552 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 34 PID 3064 wrote to memory of 2552 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 34 PID 3064 wrote to memory of 2552 3064 afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe 34 PID 2572 wrote to memory of 1728 2572 cmd.exe 35 PID 2572 wrote to memory of 1728 2572 cmd.exe 35 PID 2572 wrote to memory of 1728 2572 cmd.exe 35 PID 2572 wrote to memory of 1728 2572 cmd.exe 35 PID 2564 wrote to memory of 2716 2564 cmd.exe 36 PID 2564 wrote to memory of 2716 2564 cmd.exe 36 PID 2564 wrote to memory of 2716 2564 cmd.exe 36 PID 2564 wrote to memory of 2716 2564 cmd.exe 36 PID 2696 wrote to memory of 2736 2696 cmd.exe 37 PID 2696 wrote to memory of 2736 2696 cmd.exe 37 PID 2696 wrote to memory of 2736 2696 cmd.exe 37 PID 2696 wrote to memory of 2736 2696 cmd.exe 37 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 PID 2552 wrote to memory of 1200 2552 afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe 38 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\afdc3dc4e5703f404f366ff1595d5b60_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2716
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:1728
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
-
C:\Users\Admin\AppData\Roaming\WinDefrag\afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\WinDefrag\afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1200
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {1477C280-E5A0-4713-9C48-D25FE05E276E} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:2236
-
C:\Users\Admin\AppData\Roaming\WinDefrag\afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\WinDefrag\afdc3dc4e6803f404f377ff1696d6b70_KaffaDaket119.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:816
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2721934792-624042501-2768869379-1000\0f5007522459c86e95ffcc62f32308f1_dbaf3979-518f-4824-86e4-f33db9fb991c
Filesize1KB
MD57e6c7a2e8a92188d779b4154c7b93eb2
SHA1facff82ab612a8fd5d116094d71633d19f585fe7
SHA256f0d882cef6aa96e4a59500754cf978c39b2f228f9a4f9c3a97b9a041c2638ac2
SHA512c26ce33053a76334e1df7327725bd8c1ea6cb1525f80694020100593c4baf23ba4b1a3f50cc90a319a73cad1e2fffa08abc6d210cf33002eb084382b3c7c46a8
-
Filesize
377KB
MD5afdc3dc4e5703f404f366ff1595d5b60
SHA1acbfd6eed4667adc74879f6d3b75147cff042c02
SHA25648f79c0865a302403c6d29d9cde35cbdce9a3865780ca272ef2440968e709b7a
SHA5122130db190d646593dc5258859061312742c83a2b21007601996ee8516990ff151140b4fbc82a9eab4fbf327996dd21eac8c0f4dd424b6f5cf3292df4a80f724c