Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2024, 03:38
Behavioral task
behavioral1
Sample
98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe
-
Size
218KB
-
MD5
98c4471314f9fe3eff8396468f1ae6d0
-
SHA1
1cfe6457336c2c157e464fc0b9f112c8a5a097dd
-
SHA256
4952698c8d1ca6981aae5ffc81faaf4437900fc6a07cf70c92ece449b951410c
-
SHA512
b46078da0d3340f54cf22e0e4aed38406e0e7b6b598691e2a4f4c1d158f3338fc76aef2477ca198c3b1a193f67e0990711102fc199bd14715e433df795d5536e
-
SSDEEP
3072:tmRz3q3369AAH+jNzooQCxWaaYisqqPzrjjg9TLjY98eemgb:tM+3KmvtxWaaYisq03g93+
Malware Config
Extracted
latentbot
mrwiiwifi1irc.zapto.org
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List winlogon.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile winlogon.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications winlogon.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\Windows Live Guards = "C:\\Program Files (x86)\\winlogon.exe" winlogon.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 1524 winlogon.exe 3548 winlogon.exe -
resource yara_rule behavioral2/memory/2896-0-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3136-3-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/2896-6-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3136-7-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3136-8-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3136-9-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/files/0x000c0000000233fa-14.dat upx behavioral2/memory/3548-22-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-24-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-26-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/1524-25-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3548-32-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-34-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-35-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-36-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-37-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-38-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-39-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-40-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-41-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-42-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-43-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-44-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-45-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-46-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-47-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3548-48-0x0000000000400000-0x0000000000413000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Live Guards = "C:\\Program Files (x86)\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Live Guards = "C:\\Program Files (x86)\\winlogon.exe" winlogon.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2896 set thread context of 3136 2896 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 89 PID 1524 set thread context of 3548 1524 winlogon.exe 95 -
Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\Program Files\ICQ\Shared Files\ winlogon.exe File created C:\Program Files\Grokster\My Grokster\ winlogon.exe File created C:\Program Files (x86)\winlogon.exe 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe File created C:\Program Files\eDonkey2000\incoming winlogon.exe File created C:\Program Files\KAZAA winlogon.exe File created C:\Program Files\BearShare\Shared\ winlogon.exe File opened for modification C:\Program Files (x86)\winlogon.exe 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe File created C:\Program Files\LimeWire\Shared winlogon.exe File created C:\Program Files\Morpheus\My Shared Folder\ winlogon.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3136 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 3136 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 3136 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 3136 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 3548 winlogon.exe 3548 winlogon.exe 3548 winlogon.exe 3548 winlogon.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2896 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 1524 winlogon.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2896 wrote to memory of 3136 2896 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 89 PID 2896 wrote to memory of 3136 2896 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 89 PID 2896 wrote to memory of 3136 2896 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 89 PID 2896 wrote to memory of 3136 2896 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 89 PID 2896 wrote to memory of 3136 2896 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 89 PID 2896 wrote to memory of 3136 2896 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 89 PID 2896 wrote to memory of 3136 2896 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 89 PID 2896 wrote to memory of 3136 2896 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 89 PID 3136 wrote to memory of 1524 3136 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 92 PID 3136 wrote to memory of 1524 3136 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 92 PID 3136 wrote to memory of 1524 3136 98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe 92 PID 1524 wrote to memory of 3548 1524 winlogon.exe 95 PID 1524 wrote to memory of 3548 1524 winlogon.exe 95 PID 1524 wrote to memory of 3548 1524 winlogon.exe 95 PID 1524 wrote to memory of 3548 1524 winlogon.exe 95 PID 1524 wrote to memory of 3548 1524 winlogon.exe 95 PID 1524 wrote to memory of 3548 1524 winlogon.exe 95 PID 1524 wrote to memory of 3548 1524 winlogon.exe 95 PID 1524 wrote to memory of 3548 1524 winlogon.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\98c4471314f9fe3eff8396468f1ae6d0_JaffaCakes118.exe"2⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Program Files (x86)\winlogon.exe"C:\Program Files (x86)\winlogon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Program Files (x86)\winlogon.exe"C:\Program Files (x86)\winlogon.exe"4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3548
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD598c4471314f9fe3eff8396468f1ae6d0
SHA11cfe6457336c2c157e464fc0b9f112c8a5a097dd
SHA2564952698c8d1ca6981aae5ffc81faaf4437900fc6a07cf70c92ece449b951410c
SHA512b46078da0d3340f54cf22e0e4aed38406e0e7b6b598691e2a4f4c1d158f3338fc76aef2477ca198c3b1a193f67e0990711102fc199bd14715e433df795d5536e