Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 17:42
Static task
static1
Behavioral task
behavioral1
Sample
bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe
-
Size
752KB
-
MD5
bf21064ba18c77bb0dc141385f7e4835
-
SHA1
1ad948b5fbdb4e18a133900af8c96260aa9557e6
-
SHA256
a3d8d5d2d43c91168b7abf1a6c5823ea9d0553f5bee6ba92574c63151d52384c
-
SHA512
1e59ba40f1a495195ccd6fc343475dbbe3e82cc7601a6ffbee7d16da9b455768a153bc6b767657dc2225c80daa4c7dbb673c1b6fa2a494cecd23d828596b571d
-
SSDEEP
12288:6/Krvw0dDEW3Ngj3w+uCzd+e4SvNko6xNB+yQIwQuYo5k:8KbDoj3w+uoo9xNB50Qx
Malware Config
Signatures
-
Trickbot x86 loader 8 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/3016-0-0x0000000000290000-0x00000000002BE000-memory.dmp trickbot_loader32 behavioral1/memory/3016-3-0x0000000000290000-0x00000000002BE000-memory.dmp trickbot_loader32 behavioral1/memory/3016-2-0x00000000001B0000-0x00000000001DD000-memory.dmp trickbot_loader32 behavioral1/memory/2984-14-0x0000000001BE0000-0x0000000001C0E000-memory.dmp trickbot_loader32 behavioral1/memory/3016-19-0x0000000000290000-0x00000000002BE000-memory.dmp trickbot_loader32 behavioral1/memory/2984-20-0x0000000001BE0000-0x0000000001C0E000-memory.dmp trickbot_loader32 behavioral1/memory/2712-25-0x0000000000330000-0x000000000035E000-memory.dmp trickbot_loader32 behavioral1/memory/2712-30-0x0000000000330000-0x000000000035E000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 2984 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 2712 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe -
Loads dropped DLL 2 IoCs
pid Process 3016 bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe 3016 bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 2712 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3016 bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe 2984 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 2712 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2984 3016 bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe 30 PID 3016 wrote to memory of 2984 3016 bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe 30 PID 3016 wrote to memory of 2984 3016 bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe 30 PID 3016 wrote to memory of 2984 3016 bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe 30 PID 2984 wrote to memory of 1996 2984 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 31 PID 2984 wrote to memory of 1996 2984 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 31 PID 2984 wrote to memory of 1996 2984 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 31 PID 2984 wrote to memory of 1996 2984 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 31 PID 2984 wrote to memory of 1996 2984 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 31 PID 2984 wrote to memory of 1996 2984 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 31 PID 2964 wrote to memory of 2712 2964 taskeng.exe 33 PID 2964 wrote to memory of 2712 2964 taskeng.exe 33 PID 2964 wrote to memory of 2712 2964 taskeng.exe 33 PID 2964 wrote to memory of 2712 2964 taskeng.exe 33 PID 2712 wrote to memory of 2512 2712 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 34 PID 2712 wrote to memory of 2512 2712 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 34 PID 2712 wrote to memory of 2512 2712 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 34 PID 2712 wrote to memory of 2512 2712 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 34 PID 2712 wrote to memory of 2512 2712 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 34 PID 2712 wrote to memory of 2512 2712 bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bf21064ba18c77bb0dc141385f7e4835_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Roaming\sysdefragler\bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exeC:\Users\Admin\AppData\Roaming\sysdefragler\bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1996
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {2F456687-F30C-448B-A69F-CFD90F281368} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Roaming\sysdefragler\bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exeC:\Users\Admin\AppData\Roaming\sysdefragler\bf21084ba18c99bb0dc141387f9e4837_LaffaCameu118.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2512
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
752KB
MD5bf21064ba18c77bb0dc141385f7e4835
SHA11ad948b5fbdb4e18a133900af8c96260aa9557e6
SHA256a3d8d5d2d43c91168b7abf1a6c5823ea9d0553f5bee6ba92574c63151d52384c
SHA5121e59ba40f1a495195ccd6fc343475dbbe3e82cc7601a6ffbee7d16da9b455768a153bc6b767657dc2225c80daa4c7dbb673c1b6fa2a494cecd23d828596b571d