Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 13:51

General

  • Target

    8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe

  • Size

    141KB

  • MD5

    8a9d2d636c3eb83778a71d2912eaab6e

  • SHA1

    2df18d58f2ee33b15ee38eae2120110db9235377

  • SHA256

    d4594268a88e3240b8a3798b395f95af67d53eae1f58828df6e105dd655864c5

  • SHA512

    35176a61fafd73d9440769d26274cc42c94ce7d319a90f011ef9d073bbb16d815d98d36afb26ffd74cedf788bb1ba9083f318a13d1af424514f707b069e375f2

  • SSDEEP

    1536:4qTPSrAkdxOz/UY1pDC3iFA/cZ2IKpIPHvaSq/yiU/GOao8sCnEMvDY7hfhUxdcm:XT6k+2X3DASA/9IZPaPsaEMryqWxF7O

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1116
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1176
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1196
          • C:\Users\Admin\AppData\Local\Temp\8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe"
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2276
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp6211b072.bat"
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2760
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="explore" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Ybare\foqyva.exe"
                4⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:2656
            • C:\Users\Admin\AppData\Roaming\Ybare\foqyva.exe
              "C:\Users\Admin\AppData\Roaming\Ybare\foqyva.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2684
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp83de82a6.bat"
              3⤵
              • Deletes itself
              • System Location Discovery: System Language Discovery
              PID:1780
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1348
          • C:\Program Files\Windows Mail\WinMail.exe
            "C:\Program Files\Windows Mail\WinMail.exe" -Embedding
            1⤵
            • NTFS ADS
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:1716
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
            1⤵
              PID:3020
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
              1⤵
                PID:1392

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log

                Filesize

                2.0MB

                MD5

                31b45715098c04c63e114b5235c8db7e

                SHA1

                4271f446d9f8a31897625786bee40e008b003dc2

                SHA256

                334b5bcf0f1dfd4bdac9c13f0d2faa8b62ca6b148adf0d21585001aa13a454cd

                SHA512

                a470da1652c3b5b96d84269bd6279c962220d2d5dc7855617abf4ce79cf637f91bdf92a7274400918013f088777323a04e7fd906c85ffbb523d52f67e374cab4

              • C:\Users\Admin\AppData\Local\Temp\tmp6211b072.bat

                Filesize

                201B

                MD5

                2d86367bf62ece253d11a705316b2f3b

                SHA1

                ff3ca79572b3df65c75b0da3d7f5ebd38ec36813

                SHA256

                2c9a9e443bcc007bacc98b0c7cfaad3efe2bbc1ac5d0cb168f385aa9adfb1a62

                SHA512

                a9effb23baaf2b333beaf9403123b87163a402c5f928b6547ce052da0943c9438593ee31729e940c320935fe7aeeeb8a772be0d608667fc48620b4f6fb64134b

              • C:\Users\Admin\AppData\Local\Temp\tmp83de82a6.bat

                Filesize

                271B

                MD5

                77b65031cddb0b59ca7d496ac44ebc46

                SHA1

                289e88b8e7db72f560cf12de0c52b156672d5aa8

                SHA256

                2ca540de23857da76e7d84cd610705a0b3ab75811d070459f060ab7f19777076

                SHA512

                7b991ddd1d96336016a146e1f28b6343a702fd57b08b5b57f3547f1a7c0937b81d5da8bfacce98ae37709c01eb525c1f10d143508a5a541ad25551a9f1e33143

              • C:\Users\Admin\AppData\Roaming\Urbua\qyukerg.one

                Filesize

                380B

                MD5

                a2416c1f83939e99429c7b0b2ff441e9

                SHA1

                76a25b4116df4cec71450d5949bea02b70bd1358

                SHA256

                dbb8200a57f06321f551d9ea40f9a2e0d650868d5c7c34a4341020c25fecae42

                SHA512

                edc005ab5e3fa84aaa4481a33a309b62018705ee477c1aa8fd221cd3e9c7d78786c71f399a9baf41b00335f277d836990e51f70d650d9dc34ddcd58918c7bdf5

              • \Users\Admin\AppData\Roaming\Ybare\foqyva.exe

                Filesize

                141KB

                MD5

                31a36b22a3f6ae8f438fe3b752efbc26

                SHA1

                584b7e8f5c8b811fa6f920b1ec06425a2eabd84c

                SHA256

                eb643c947fa51b8a4a39ce509fc4e51cd8af39b74a8451b8dd8b54a2c7316f7d

                SHA512

                95e66dfe1371ab29ef1d9b3c1b8f1851e256b6f9c93d17aa8534f3e4df482dc66c8d6787f5555150fca4d10a9f78bf58e7319783e9407683bc6090b403ef7a43

              • memory/1116-21-0x00000000021E0000-0x0000000002207000-memory.dmp

                Filesize

                156KB

              • memory/1116-20-0x00000000021E0000-0x0000000002207000-memory.dmp

                Filesize

                156KB

              • memory/1116-18-0x00000000021E0000-0x0000000002207000-memory.dmp

                Filesize

                156KB

              • memory/1116-19-0x00000000021E0000-0x0000000002207000-memory.dmp

                Filesize

                156KB

              • memory/1116-22-0x00000000021E0000-0x0000000002207000-memory.dmp

                Filesize

                156KB

              • memory/1176-27-0x0000000002130000-0x0000000002157000-memory.dmp

                Filesize

                156KB

              • memory/1176-25-0x0000000002130000-0x0000000002157000-memory.dmp

                Filesize

                156KB

              • memory/1176-24-0x0000000002130000-0x0000000002157000-memory.dmp

                Filesize

                156KB

              • memory/1176-26-0x0000000002130000-0x0000000002157000-memory.dmp

                Filesize

                156KB

              • memory/1196-30-0x0000000002D50000-0x0000000002D77000-memory.dmp

                Filesize

                156KB

              • memory/1196-29-0x0000000002D50000-0x0000000002D77000-memory.dmp

                Filesize

                156KB

              • memory/1196-32-0x0000000002D50000-0x0000000002D77000-memory.dmp

                Filesize

                156KB

              • memory/1196-31-0x0000000002D50000-0x0000000002D77000-memory.dmp

                Filesize

                156KB

              • memory/1348-42-0x0000000001E20000-0x0000000001E47000-memory.dmp

                Filesize

                156KB

              • memory/1348-40-0x0000000001E20000-0x0000000001E47000-memory.dmp

                Filesize

                156KB

              • memory/1348-38-0x0000000001E20000-0x0000000001E47000-memory.dmp

                Filesize

                156KB

              • memory/1348-36-0x0000000001E20000-0x0000000001E47000-memory.dmp

                Filesize

                156KB

              • memory/2276-52-0x0000000000320000-0x0000000000347000-memory.dmp

                Filesize

                156KB

              • memory/2276-81-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-50-0x0000000000320000-0x0000000000347000-memory.dmp

                Filesize

                156KB

              • memory/2276-0-0x0000000000403000-0x0000000000407000-memory.dmp

                Filesize

                16KB

              • memory/2276-54-0x0000000000320000-0x0000000000347000-memory.dmp

                Filesize

                156KB

              • memory/2276-1-0x0000000000400000-0x0000000000449000-memory.dmp

                Filesize

                292KB

              • memory/2276-46-0x0000000000320000-0x0000000000347000-memory.dmp

                Filesize

                156KB

              • memory/2276-230-0x0000000000400000-0x0000000000449000-memory.dmp

                Filesize

                292KB

              • memory/2276-2-0x0000000000400000-0x0000000000449000-memory.dmp

                Filesize

                292KB

              • memory/2276-63-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-61-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-59-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-69-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-67-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-71-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-65-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-75-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-73-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-57-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-55-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-83-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-132-0x0000000000400000-0x0000000000449000-memory.dmp

                Filesize

                292KB

              • memory/2276-48-0x0000000000320000-0x0000000000347000-memory.dmp

                Filesize

                156KB

              • memory/2276-79-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-78-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2276-3-0x0000000000400000-0x0000000000449000-memory.dmp

                Filesize

                292KB

              • memory/2276-168-0x0000000000403000-0x0000000000407000-memory.dmp

                Filesize

                16KB

              • memory/2684-14-0x0000000000400000-0x0000000000449000-memory.dmp

                Filesize

                292KB

              • memory/2684-16-0x0000000000400000-0x0000000000449000-memory.dmp

                Filesize

                292KB

              • memory/2684-33-0x0000000000400000-0x0000000000449000-memory.dmp

                Filesize

                292KB

              • memory/2684-347-0x0000000000400000-0x0000000000449000-memory.dmp

                Filesize

                292KB