Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    27/07/2024, 02:39

General

  • Target

    76c090f1bbc12453b6046736daa7009b_JaffaCakes118.exe

  • Size

    222KB

  • MD5

    76c090f1bbc12453b6046736daa7009b

  • SHA1

    d18483537a06195adae4376b66ebb992fa4f39be

  • SHA256

    15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d

  • SHA512

    fe33ed15e6b13ad0e45222324ba75ebed11e6198427e2edd93d9ba7160b224f26e8062c0bdc3e8caff371e1a96940eae1c358da32aab9c819ce6559970194786

  • SSDEEP

    3072:3hvsRJUV7ZdyQod/TGEMVmoEzlWln9b4ct+bIF6LjFkF3karC1t1TB1Me6i9E:RvHT/GMdExW96ctdcL+F3karCJFGe6k

Malware Config

Extracted

Family

netwire

C2

haija.mine.nu:1338

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    aegistools2

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    qays1122

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 10 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76c090f1bbc12453b6046736daa7009b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\76c090f1bbc12453b6046736daa7009b_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\SysWow64\svchost.exe
      "C:\\Windows\\SysWow64\\svchost.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1916-11-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1916-10-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1916-21-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1916-18-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1916-5-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1916-7-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1916-13-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1916-6-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1916-8-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1916-9-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1916-19-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1916-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2112-0-0x000007FEF5A03000-0x000007FEF5A04000-memory.dmp

    Filesize

    4KB

  • memory/2112-3-0x0000000000140000-0x0000000000148000-memory.dmp

    Filesize

    32KB

  • memory/2112-17-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

    Filesize

    9.9MB

  • memory/2112-1-0x000000013FBA0000-0x000000013FBDC000-memory.dmp

    Filesize

    240KB

  • memory/2112-20-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

    Filesize

    9.9MB

  • memory/2112-4-0x00000000005F0000-0x0000000000623000-memory.dmp

    Filesize

    204KB

  • memory/2112-2-0x0000000000550000-0x000000000057E000-memory.dmp

    Filesize

    184KB