Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 03:32

General

  • Target

    b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe

  • Size

    183KB

  • MD5

    b62ffd49bff76c8fb3e94e4d6d7eef38

  • SHA1

    9b8c52cc18f41ddf985879a950ee8f4d72713fd7

  • SHA256

    ee9b6d599fa083106b88969579de65a53ac6c9e1f5d30f4309a6ad557d7348ff

  • SHA512

    bffa9d3644d9fddf50a0f58637fc04f7ae0cc5dc198ffcdaf41a7f34c92da3e985039220530d5f250ac7b910d2c4dd0743fa2cc102a6edc23888349664013856

  • SSDEEP

    3072:bMqKbTtCSIT0chwzzcdZKF8UvvoeWofjjpAVioRF8s//NLj6h+EvtRHD:o9MMmwzlqUHoeWofjjpAViY/lH6h+Evj

Malware Config

Signatures

  • Gh0st RAT payload 4 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Service Discovery 1 TTPs 2 IoCs

    Adversaries may try to gather information about registered local system services.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\XXXXXX294B1FA4\JH.BAT
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1336
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn * /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2364
      • C:\Windows\SysWOW64\sc.exe
        sc config Schedule start= auto
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2472
      • C:\Windows\SysWOW64\net.exe
        net start "Task Scheduler"
        3⤵
        • System Location Discovery: System Language Discovery
        • System Service Discovery
        • Suspicious use of WriteProcessMemory
        PID:868
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start "Task Scheduler"
          4⤵
          • System Location Discovery: System Language Discovery
          • System Service Discovery
          PID:2708
      • C:\Windows\SysWOW64\at.exe
        At 0:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:576
      • C:\Windows\SysWOW64\at.exe
        At 1:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2704
      • C:\Windows\SysWOW64\at.exe
        At 2:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2860
      • C:\Windows\SysWOW64\at.exe
        At 3:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3060
      • C:\Windows\SysWOW64\at.exe
        At 4:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2748
      • C:\Windows\SysWOW64\at.exe
        At 5:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2216
      • C:\Windows\SysWOW64\at.exe
        At 6:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3052
      • C:\Windows\SysWOW64\at.exe
        At 7:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2552
      • C:\Windows\SysWOW64\at.exe
        At 8:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2964
      • C:\Windows\SysWOW64\at.exe
        At 9:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1028
      • C:\Windows\SysWOW64\at.exe
        At 10:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2772
      • C:\Windows\SysWOW64\at.exe
        At 11:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2428
      • C:\Windows\SysWOW64\at.exe
        At 12:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2608
      • C:\Windows\SysWOW64\at.exe
        At 13:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2640
      • C:\Windows\SysWOW64\at.exe
        At 14:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2720
      • C:\Windows\SysWOW64\at.exe
        At 15:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2648
      • C:\Windows\SysWOW64\at.exe
        At 16:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:796
      • C:\Windows\SysWOW64\at.exe
        At 17:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:468
      • C:\Windows\SysWOW64\at.exe
        At 18:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:836
      • C:\Windows\SysWOW64\at.exe
        At 19:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:848
      • C:\Windows\SysWOW64\at.exe
        At 20:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1836
      • C:\Windows\SysWOW64\at.exe
        At 21:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2036
      • C:\Windows\SysWOW64\at.exe
        At 22:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2796
      • C:\Windows\SysWOW64\at.exe
        At 23:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1628
      • C:\Windows\SysWOW64\at.exe
        At 24:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1364

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\XXXXXX294B1FA4\JH.BAT

    Filesize

    1KB

    MD5

    0794cf28a0162c1bf6c662fda2e5a9f1

    SHA1

    052e1dd1bd2bd5e64acd9bb3134747242c76cba5

    SHA256

    6dea3dabef075fa44b2ba8728b83cebc929c944f909b49f5e243b4597aab3266

    SHA512

    9b1c915958523a9d15f0108f8daa127592b98e6d806ce58155c0994e2f9bc98103d2c5389c05d6f5f0e86de53c92b39d4603072a1d1239965569711490469dc8

  • memory/2420-9-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2420-8-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/2420-5-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/2420-2-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/2420-0-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/2420-18-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/2420-19-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2420-20-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB