Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
34s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 22:19
Static task
static1
Behavioral task
behavioral1
Sample
87e5dcb02f61ef2182304357ce1bf06e_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
87e5dcb02f61ef2182304357ce1bf06e_JaffaCakes118.exe
-
Size
95KB
-
MD5
87e5dcb02f61ef2182304357ce1bf06e
-
SHA1
95fd9335eb432bfcf2ec850a1e663bf1ab4901be
-
SHA256
8943ed28c6d1d8f0e9792acfc2e47bfb21adc1d006a751a91c30fc6ba0868e22
-
SHA512
6246266f88977d13f6d14e7e9360ae5c8aa6d21e63c1f526e28ad669023f49f8b56780d53b2b85f63b180e72d4d4aed028f596adc55223fb56161230485d3a84
-
SSDEEP
1536:X0FusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prh8sze8KZtAd:XGS4jHS8q/3nTzePCwNUh4E9h8bhtAd
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x0008000000016d58-20.dat family_gh0strat behavioral1/memory/2884-23-0x0000000000400000-0x000000000044E37C-memory.dmp family_gh0strat -
Deletes itself 1 IoCs
pid Process 2884 gsyhmnopgq -
Executes dropped EXE 1 IoCs
pid Process 2884 gsyhmnopgq -
Loads dropped DLL 3 IoCs
pid Process 1924 87e5dcb02f61ef2182304357ce1bf06e_JaffaCakes118.exe 1924 87e5dcb02f61ef2182304357ce1bf06e_JaffaCakes118.exe 2812 svchost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\snjpitrnum svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87e5dcb02f61ef2182304357ce1bf06e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gsyhmnopgq Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2884 gsyhmnopgq 2812 svchost.exe 2812 svchost.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeRestorePrivilege 2884 gsyhmnopgq Token: SeBackupPrivilege 2884 gsyhmnopgq Token: SeBackupPrivilege 2884 gsyhmnopgq Token: SeRestorePrivilege 2884 gsyhmnopgq Token: SeBackupPrivilege 2812 svchost.exe Token: SeRestorePrivilege 2812 svchost.exe Token: SeBackupPrivilege 2812 svchost.exe Token: SeBackupPrivilege 2812 svchost.exe Token: SeSecurityPrivilege 2812 svchost.exe Token: SeSecurityPrivilege 2812 svchost.exe Token: SeBackupPrivilege 2812 svchost.exe Token: SeBackupPrivilege 2812 svchost.exe Token: SeSecurityPrivilege 2812 svchost.exe Token: SeBackupPrivilege 2812 svchost.exe Token: SeBackupPrivilege 2812 svchost.exe Token: SeSecurityPrivilege 2812 svchost.exe Token: SeBackupPrivilege 2812 svchost.exe Token: SeRestorePrivilege 2812 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2884 1924 87e5dcb02f61ef2182304357ce1bf06e_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2884 1924 87e5dcb02f61ef2182304357ce1bf06e_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2884 1924 87e5dcb02f61ef2182304357ce1bf06e_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2884 1924 87e5dcb02f61ef2182304357ce1bf06e_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\87e5dcb02f61ef2182304357ce1bf06e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\87e5dcb02f61ef2182304357ce1bf06e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\users\admin\appdata\local\gsyhmnopgq"C:\Users\Admin\AppData\Local\Temp\87e5dcb02f61ef2182304357ce1bf06e_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\87e5dcb02f61ef2182304357ce1bf06e_jaffacakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24.0MB
MD539d5eb2b0e07a5d2eac6ce632681c9c2
SHA1a297e672aedc9721fe92ba1d9ae1c3f909186660
SHA256d6b75ff5abe8b3cb19a4270cd44d531d37f383c76b7c426ebd92ea5acb1decd5
SHA512cb28356f820b3918c49a6379b1f58cd83f8a0046e96c39edca0f9cac96089d036f30deb51091622f4f39b9df15bf499db5dabe1c3738563e969f20a1f166490e
-
Filesize
23.3MB
MD5360a5cd551c815efd1f6899596a2c357
SHA18a14fe967c3a28d05f0c9ee850bb6cfe3cab85ec
SHA256f3a90d49c14e71c4da7fa173297ed1741c903a52dd974baf3031531fb3ad6a0e
SHA5129b847f954cfdfafb4f83541d5187b212579f4e0bbec90e06dda643f5196b98345ccd795662a9e5f79946371289e14777a2aae6c19274f3dfa00cc2aabff55190