Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2024, 03:01
Static task
static1
Behavioral task
behavioral1
Sample
c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe
-
Size
540KB
-
MD5
c43f9a6bbb9ae4e618d4a72c626259d4
-
SHA1
b0d56df59de23d693e9d2bcfde5569c683895715
-
SHA256
d05b01de0d1bd816e1024cb47ba0b5c2205cc3aa274e466d59a39052ad945c36
-
SHA512
9b237dbcb32e0e5cba0d15c954c6bd830cee42d0235083a3d6dff49e6b25968ae797006fe432a264ee59b3e2139b0b40fd6479dfb14c2912df1cf91abb3a6fb6
-
SSDEEP
3072:lYFzyxPM+ETS8wwyd+Z9vZ9hiCeZI9rliT/qyqms1XIfnEL08kRk60RjH:lYJyxPML/OwFhiu9rlqa71MEL0P7uj
Malware Config
Extracted
netwire
cowboyz.climatechangeawareness.uk:31256
-
activex_autorun
true
-
activex_key
{3BGD0153-4IDF-FT00-RY63-XFA4O7NRPM6W}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
pbNlVBON
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
true
Signatures
-
NetWire RAT payload 3 IoCs
resource yara_rule behavioral2/memory/2352-6-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral2/memory/2352-13-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral2/memory/2352-11-0x0000000000400000-0x000000000042B000-memory.dmp netwire -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 564 set thread context of 2352 564 c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe 85 PID 564 set thread context of 2996 564 c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe 84 -
Program crash 2 IoCs
pid pid_target Process procid_target 3260 2352 WerFault.exe 85 3236 2996 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 564 c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe 564 c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 564 wrote to memory of 2996 564 c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe 84 PID 564 wrote to memory of 2996 564 c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe 84 PID 564 wrote to memory of 2996 564 c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe 84 PID 564 wrote to memory of 2352 564 c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe 85 PID 564 wrote to memory of 2352 564 c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe 85 PID 564 wrote to memory of 2352 564 c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe 85 PID 564 wrote to memory of 2996 564 c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe 84 PID 564 wrote to memory of 2352 564 c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 5803⤵
- Program crash
PID:3236
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 5803⤵
- Program crash
PID:3260
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2352 -ip 23521⤵PID:4516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2996 -ip 29961⤵PID:2816