Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 02:24

General

  • Target

    b5fdc9452d7cd3ccda9973d010f23f12_JaffaCakes118.exe

  • Size

    138KB

  • MD5

    b5fdc9452d7cd3ccda9973d010f23f12

  • SHA1

    d82fabdfd5c5d5bcfd713ea5a55b4a8e8105a123

  • SHA256

    4fc371d56223ad9a441fd056abf5d879846b040183dd49ad465c6d9111728fda

  • SHA512

    d7ee45e7cf1b8635f552de6d8e9832c292db68dc42617f75afc0e093dc41543c86e8f66b1a3c352a8ae5b70e7d17681a2ba1aae28caf5d662d629b1d39b7fce5

  • SSDEEP

    3072:7tsaTXp2uHKN/BDzh/5jrCIHer7Zmv3HSruNyLamWjMAKdWrc:7Garp2uHKNfYJmaiNyVWPdrc

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1232
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1336
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1392
          • C:\Users\Admin\AppData\Local\Temp\b5fdc9452d7cd3ccda9973d010f23f12_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\b5fdc9452d7cd3ccda9973d010f23f12_JaffaCakes118.exe"
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2256
            • C:\Users\Admin\AppData\Roaming\Sood\nuon.exe
              "C:\Users\Admin\AppData\Roaming\Sood\nuon.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2196
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpfba394dd.bat"
              3⤵
              • Deletes itself
              • System Location Discovery: System Language Discovery
              PID:1552
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:932
          • C:\Program Files\Windows Mail\WinMail.exe
            "C:\Program Files\Windows Mail\WinMail.exe" -Embedding
            1⤵
            • NTFS ADS
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:1300
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
            1⤵
              PID:2052

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log

              Filesize

              2.0MB

              MD5

              a4ef312851ddb13d03d6178d1f3f26e3

              SHA1

              855ae2ef153c8d5a001130003ec7cc9716a813c7

              SHA256

              df0141e7eb0f839b9375584c71e64b88051d799a1adc08ddff0b8f4459dabb1c

              SHA512

              3648c78ac80b9ffb09b0f62d24bddb6bb964a797f44ff1e9656a323b0d201f5fa6a30db7755f34c85e5987b180c3ae7d59b55adefb67fde1c0ffb7e0d629bacc

            • C:\Users\Admin\AppData\Local\Temp\tmpfba394dd.bat

              Filesize

              271B

              MD5

              a2427cfc79fa97f7a64e25a7a993dffb

              SHA1

              a68180ef175e8085abe4da33d755e676a924bf21

              SHA256

              d0cc1a6121319543acf857f48f3720d9250cf52fa054302830fa7db9ab1a6eeb

              SHA512

              39aafcb6381ed749d5ea44309be7c3a729092eda364f089ce4fbb6516ed326ca2e82890dd08d907466f1f1bb53e992e08789c1039687e12b58dc7ec690270e0b

            • C:\Users\Admin\AppData\Roaming\Zeymf\bakou.oki

              Filesize

              380B

              MD5

              c984c73164e39e6d4f32da24433730d2

              SHA1

              375afd220856cdac6717c3919fbcbb2416d7b0cb

              SHA256

              fdb0c9be016f58899d98a07e4d7e1b69ab6d050ed587072a40c382bee888047a

              SHA512

              91fa265d9b188b572eccdb8965eeda7abef690393756766916a4247a95796c64d42792ceb7001b1e9911d74fe2fc929d746dc6784853cb319e7ae4a4798913e1

            • \Users\Admin\AppData\Roaming\Sood\nuon.exe

              Filesize

              138KB

              MD5

              05f713d9c600fe9123b9eb47dbd81dc3

              SHA1

              ea73334e04e82fc29b14242179b90672b443f005

              SHA256

              e6c251ae96023bbc9d35d0d31c871c30ea30e6770ec911bbed98849155f9c6d5

              SHA512

              f19eadaa03e71e94084a3f3c98d9bfb4130c8567141b98ecd675be2bc3c5c224fca1e32bff4ad4bf7c16aa0659d033414e0088f1ff8d2b8a6b4ebaedbb99710b

            • memory/932-32-0x0000000002490000-0x00000000024B7000-memory.dmp

              Filesize

              156KB

            • memory/932-31-0x0000000002490000-0x00000000024B7000-memory.dmp

              Filesize

              156KB

            • memory/932-34-0x0000000002490000-0x00000000024B7000-memory.dmp

              Filesize

              156KB

            • memory/932-33-0x0000000002490000-0x00000000024B7000-memory.dmp

              Filesize

              156KB

            • memory/1232-10-0x0000000001BC0000-0x0000000001BE7000-memory.dmp

              Filesize

              156KB

            • memory/1232-11-0x0000000001BC0000-0x0000000001BE7000-memory.dmp

              Filesize

              156KB

            • memory/1232-12-0x0000000001BC0000-0x0000000001BE7000-memory.dmp

              Filesize

              156KB

            • memory/1232-13-0x0000000001BC0000-0x0000000001BE7000-memory.dmp

              Filesize

              156KB

            • memory/1232-14-0x0000000001BC0000-0x0000000001BE7000-memory.dmp

              Filesize

              156KB

            • memory/1336-22-0x00000000001A0000-0x00000000001C7000-memory.dmp

              Filesize

              156KB

            • memory/1336-17-0x00000000001A0000-0x00000000001C7000-memory.dmp

              Filesize

              156KB

            • memory/1336-19-0x00000000001A0000-0x00000000001C7000-memory.dmp

              Filesize

              156KB

            • memory/1336-23-0x00000000001A0000-0x00000000001C7000-memory.dmp

              Filesize

              156KB

            • memory/1392-26-0x0000000002A10000-0x0000000002A37000-memory.dmp

              Filesize

              156KB

            • memory/1392-27-0x0000000002A10000-0x0000000002A37000-memory.dmp

              Filesize

              156KB

            • memory/1392-28-0x0000000002A10000-0x0000000002A37000-memory.dmp

              Filesize

              156KB

            • memory/1392-29-0x0000000002A10000-0x0000000002A37000-memory.dmp

              Filesize

              156KB

            • memory/2256-123-0x0000000000270000-0x0000000000297000-memory.dmp

              Filesize

              156KB

            • memory/2256-63-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-47-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-45-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-39-0x0000000000270000-0x0000000000297000-memory.dmp

              Filesize

              156KB

            • memory/2256-38-0x0000000000270000-0x0000000000297000-memory.dmp

              Filesize

              156KB

            • memory/2256-37-0x0000000000270000-0x0000000000297000-memory.dmp

              Filesize

              156KB

            • memory/2256-51-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-53-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-55-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-57-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-59-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-61-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-49-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-65-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-73-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-67-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-69-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-43-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-41-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-124-0x0000000076EF0000-0x0000000076EF1000-memory.dmp

              Filesize

              4KB

            • memory/2256-125-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-71-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2256-40-0x0000000000270000-0x0000000000297000-memory.dmp

              Filesize

              156KB

            • memory/2256-36-0x0000000000270000-0x0000000000297000-memory.dmp

              Filesize

              156KB