Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    70s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    26/08/2024, 17:14

General

  • Target

    c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe

  • Size

    348KB

  • MD5

    c376bf2085e4a128138f9670a00238df

  • SHA1

    a07d8e9154ab987d6ec086fe1998e765acca2e08

  • SHA256

    49b88c44acd0ac95bdf30f02c4692e4e46010363fb5609278837a998819c02f4

  • SHA512

    2483fab364e3d0f0df484dba14f7af75c3b429de168a835a7f75d0c41482accac8dd014b5901960ab39b5890bd359ac6fd9ae2d2bc2855fe1923bce56451745d

  • SSDEEP

    3072:iBVIprHpt3UJUx8J8BlA4wgfrgT5iH0OBZgD+GkG8sp40aHP00Wm6E6lW7mf2gq+:iBqZzx8GXfETq3Bxesci6OjgqlQex8

Malware Config

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Drops file in System32 directory 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Windows\SysWOW64\cmd.exe
      /c sc stop WinDefend
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Windows\SysWOW64\sc.exe
        sc stop WinDefend
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2804
    • C:\Windows\SysWOW64\cmd.exe
      /c sc delete WinDefend
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Windows\SysWOW64\sc.exe
        sc delete WinDefend
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2680
    • C:\Windows\SysWOW64\cmd.exe
      /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2772
    • C:\Users\Admin\AppData\Roaming\WNetval\c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe
      C:\Users\Admin\AppData\Roaming\WNetval\c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:3044
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {A60E60F2-B6C8-45E5-82CB-DE8D9511AC1E} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Users\Admin\AppData\Roaming\WNetval\c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe
        C:\Users\Admin\AppData\Roaming\WNetval\c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2852
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          3⤵
            PID:676

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Roaming\WNetval\c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe

        Filesize

        348KB

        MD5

        c376bf2085e4a128138f9670a00238df

        SHA1

        a07d8e9154ab987d6ec086fe1998e765acca2e08

        SHA256

        49b88c44acd0ac95bdf30f02c4692e4e46010363fb5609278837a998819c02f4

        SHA512

        2483fab364e3d0f0df484dba14f7af75c3b429de168a835a7f75d0c41482accac8dd014b5901960ab39b5890bd359ac6fd9ae2d2bc2855fe1923bce56451745d

      • memory/628-2-0x00000000002F0000-0x00000000002F1000-memory.dmp

        Filesize

        4KB

      • memory/628-15-0x0000000000300000-0x0000000000329000-memory.dmp

        Filesize

        164KB

      • memory/628-13-0x00000000002F0000-0x00000000002F1000-memory.dmp

        Filesize

        4KB

      • memory/628-12-0x00000000002F0000-0x00000000002F1000-memory.dmp

        Filesize

        4KB

      • memory/628-18-0x0000000000400000-0x0000000000459000-memory.dmp

        Filesize

        356KB

      • memory/628-10-0x00000000002F0000-0x00000000002F1000-memory.dmp

        Filesize

        4KB

      • memory/628-9-0x00000000002F0000-0x00000000002F1000-memory.dmp

        Filesize

        4KB

      • memory/628-8-0x00000000002F0000-0x00000000002F1000-memory.dmp

        Filesize

        4KB

      • memory/628-7-0x00000000002F0000-0x00000000002F1000-memory.dmp

        Filesize

        4KB

      • memory/628-6-0x00000000002F0000-0x00000000002F1000-memory.dmp

        Filesize

        4KB

      • memory/628-5-0x00000000002F0000-0x00000000002F1000-memory.dmp

        Filesize

        4KB

      • memory/628-4-0x00000000002F0000-0x00000000002F1000-memory.dmp

        Filesize

        4KB

      • memory/628-14-0x00000000002F0000-0x00000000002F1000-memory.dmp

        Filesize

        4KB

      • memory/628-3-0x00000000002F0000-0x00000000002F1000-memory.dmp

        Filesize

        4KB

      • memory/628-11-0x00000000002F0000-0x00000000002F1000-memory.dmp

        Filesize

        4KB

      • memory/628-17-0x000000000042C000-0x000000000042D000-memory.dmp

        Filesize

        4KB

      • memory/2852-71-0x0000000000330000-0x0000000000331000-memory.dmp

        Filesize

        4KB

      • memory/2852-70-0x0000000000330000-0x0000000000331000-memory.dmp

        Filesize

        4KB

      • memory/2852-69-0x0000000000330000-0x0000000000331000-memory.dmp

        Filesize

        4KB

      • memory/2852-61-0x0000000000330000-0x0000000000331000-memory.dmp

        Filesize

        4KB

      • memory/2852-68-0x0000000000330000-0x0000000000331000-memory.dmp

        Filesize

        4KB

      • memory/2852-67-0x0000000000330000-0x0000000000331000-memory.dmp

        Filesize

        4KB

      • memory/2852-60-0x0000000000330000-0x0000000000331000-memory.dmp

        Filesize

        4KB

      • memory/2852-65-0x0000000000330000-0x0000000000331000-memory.dmp

        Filesize

        4KB

      • memory/2852-62-0x0000000000330000-0x0000000000331000-memory.dmp

        Filesize

        4KB

      • memory/2852-63-0x0000000000330000-0x0000000000331000-memory.dmp

        Filesize

        4KB

      • memory/2852-64-0x0000000000330000-0x0000000000331000-memory.dmp

        Filesize

        4KB

      • memory/2852-66-0x0000000000330000-0x0000000000331000-memory.dmp

        Filesize

        4KB

      • memory/2916-47-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/2916-38-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2916-33-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2916-34-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2916-35-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2916-36-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2916-37-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2916-32-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2916-39-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2916-40-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2916-41-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2916-43-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2916-42-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/3044-50-0x0000000010000000-0x000000001001F000-memory.dmp

        Filesize

        124KB