Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/06/2024, 09:27
Static task
static1
Behavioral task
behavioral1
Sample
b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe
-
Size
539KB
-
MD5
b7e3a34777762e23320ac86a0dc0e13d
-
SHA1
144e81a97b40bdd0c084d2bdb3de2f1b8cecc597
-
SHA256
5b3692b40de137cd31116d42ed879e98ffce063ad118c88e83e0eb8eeda720a7
-
SHA512
8b3d4f147115386d6b49c4858a17bf11558b3302ee86fc98033c8a886dd295bdfe8fdd2d064c5856309c3466e9656e19452cc5487a10d4fdf4ef1ce285c0f67a
-
SSDEEP
6144:30kAoJOWlY4KCi5E/vbBIPcSO1KiB4tgq1:nFYMiG/vbnoiBOL
Malware Config
Extracted
netwire
noapology.climatechangeawareness.uk:2001
-
activex_autorun
true
-
activex_key
{4N3IXX84-X7C0-1FI7-0YT5-2HLCU3K0W152}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
TtUhMGhJ
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
true
Signatures
-
NetWire RAT payload 3 IoCs
resource yara_rule behavioral2/memory/3988-6-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral2/memory/3988-10-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral2/memory/3988-8-0x0000000000400000-0x000000000042B000-memory.dmp netwire -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1240 set thread context of 3988 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe 83 PID 1240 set thread context of 1644 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe 84 -
Program crash 2 IoCs
pid pid_target Process procid_target 552 1644 WerFault.exe 84 4716 3988 WerFault.exe 83 -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1240 wrote to memory of 3988 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe 83 PID 1240 wrote to memory of 3988 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe 83 PID 1240 wrote to memory of 3988 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe 83 PID 1240 wrote to memory of 3988 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe 83 PID 1240 wrote to memory of 1644 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe 84 PID 1240 wrote to memory of 1644 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe 84 PID 1240 wrote to memory of 1644 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe 84 PID 1240 wrote to memory of 1644 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 5803⤵
- Program crash
PID:4716
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 5803⤵
- Program crash
PID:552
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3988 -ip 39881⤵PID:508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1644 -ip 16441⤵PID:100