Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 20:28

General

  • Target

    8bd9a3095ebb74383c3103bfc41765b0_JaffaCakes118.exe

  • Size

    4.8MB

  • MD5

    8bd9a3095ebb74383c3103bfc41765b0

  • SHA1

    a7b38182caa24927955d49740496dbb432c6363b

  • SHA256

    20a45fa6c17c9e8461522886352a440c2c00a6a16075004f3d731876631c3696

  • SHA512

    a4aca9d5b1ab785822b9913c6d4d10aa7244873445982806f4ada9fa47c01a2f28ccbb4b5d1234e5af9a164997924ff342e44e7ad47b6014831e40ac3a51f577

  • SSDEEP

    98304:KrgJubL1bcRIRDF7nO9X3ll3MZXsKdaoTgkuKL21WKtxa9/nj:KZ9wohLI3fcZXRcVKL21K9/nj

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 12 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 59 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bd9a3095ebb74383c3103bfc41765b0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8bd9a3095ebb74383c3103bfc41765b0_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\LANGHUA\LangHua.exe" 7k7kÓÎÏ·ºÐ ENABLE
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\LANGHUA\Skin\default\SbujectSkin\Angry Birds HD\TopPanelBKMid.bmp

    Filesize

    292B

    MD5

    bef63375cea722bdae589b6d216e26a0

    SHA1

    3a936fc239861cc9abcd4b07c180b223046a82bc

    SHA256

    b949bf373d756634b2855851023535c5a8df6bfe1172458725aee7a97dd94dbd

    SHA512

    8df9f0aaec09c6717bf8d580f617abd5363c9008bf6d337cdfe7db628b1896337039fdf5d4b0f3e99cd31da25e8c8867c5c7d67a56d007d8895628498af46b38

  • C:\Program Files (x86)\LANGHUA\config.ini

    Filesize

    832B

    MD5

    3c22a589918880a4220af43e1baa1263

    SHA1

    767a957cbf71932ae4449c42baf711445adbc123

    SHA256

    4b441cf4d704fa561ca70dfab621a767607717ccae4438150cda0a1b87ed200e

    SHA512

    89902c687a3b2b6ac9c722b9c015ee2d39a2cb44fdf6227b3527986af6dc971b76b08bc36a92d46f4147030cc1900830388605477e2dc352b16387138f53742d

  • C:\Users\Admin\AppData\Local\Temp\nstDBB1.tmp\ebanner.dll

    Filesize

    9KB

    MD5

    d4eb94400c76da205cbf83cb42cf1e6c

    SHA1

    fdbb4723dd8c2d2c3a2ae0616419bb27db7c4de7

    SHA256

    d5a2884190caf25783c0abd32875f8c700abbec9f245bbee7e2584358ea864dc

    SHA512

    2fb517dd94e0c57cc9875229735ee5bedffe5a60d90c741299328ff625b7f25894c7a0308fda9c29d5daf667230e5f923591632c612d607774da303e2dba5050

  • \Program Files (x86)\LANGHUA\LHInstall.dll

    Filesize

    37KB

    MD5

    baaba3043095985cd25a2ed145bec930

    SHA1

    e5db0602c0ce554a4312227be9040bac6a7695bc

    SHA256

    56c28ece9745b056b505348ee56f6a2340d40039741f60860d23ae86cc8c1fbb

    SHA512

    13c4b7cca681ba65d057eb3bf8a4ea6261f9acd414f0ff07c6dbdfca44d5b1198307ed5d8806114bd4b4a41017c232e563798b52e7ddc800f2f03ef0711dbbbb

  • \Program Files (x86)\LANGHUA\LangHua.exe

    Filesize

    2.1MB

    MD5

    4d1770fca9559746469e30933b4d83fd

    SHA1

    f0b0a86cb17f06aaa808e073e5e4c25a55057e1b

    SHA256

    d50be917d4aa3352b4adbed554517f1a473bda771c6e70cdc0431ebb08fa3ca5

    SHA512

    f5ec293042bbd838f283f89772375c33236cb0777490722fd1eb394d60677523c80eeb9f7ba742c919806d42cbb2922824130e821b65bb203e13e95257d8bf02

  • \Program Files (x86)\LANGHUA\msvcr71.dll

    Filesize

    345KB

    MD5

    c1c6767e9a17b17fdd00232fa7e57c5e

    SHA1

    1dcbdafbe96043da6eac5f56e5fe58ac4075f755

    SHA256

    7178e784dd51d94927c368926191aeb276fcd7b535580394e481d884412965b5

    SHA512

    613c3a6d0c027e6261f95adc3c20d4f556de43a664cb2fc653f42418bb4ee7c5b7572b83a6ffb27512516afde805538d0ea181dd5c8180539b731d328a451a7c

  • \Users\Admin\AppData\Local\Temp\nstDBB1.tmp\LhNsis.dll

    Filesize

    136KB

    MD5

    c7e90bf806485f29fd6a12d55cc9345b

    SHA1

    4c67092cc34e82c8a12d2992ed31393bc1af6ea9

    SHA256

    c91224d0a6beebc46fef20ce716852ccccc1cbb6f12f117ed2e45f83417b0f92

    SHA512

    b19fe4017475a22e83d26822bce9eb7406bbffebc3fe3b7faff4ecda1fd84f975405ad814c0f09c63b55174b4a940b818f534540334bcecf7e424d84eee7b646

  • \Users\Admin\AppData\Local\Temp\nstDBB1.tmp\System.dll

    Filesize

    10KB

    MD5

    4eff5fafd746f5decb93a44e3a3d570c

    SHA1

    a11aa7681b7e2df1c7f7492a127d332d1495ea8a

    SHA256

    cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5

    SHA512

    cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72

  • memory/2984-26-0x0000000002AC0000-0x0000000002AE5000-memory.dmp

    Filesize

    148KB

  • memory/2984-372-0x0000000002AC0000-0x0000000002ACB000-memory.dmp

    Filesize

    44KB