Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/09/2024, 09:11 UTC

General

  • Target

    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe

  • Size

    632KB

  • MD5

    e225fbb1197c694a002c405b7b0100c1

  • SHA1

    78a2309485471ed0922bc9ae0623b0fca7f5d26d

  • SHA256

    570626631a17f1a8864203810fc62b05e1bcba11f5d29ba125d276377fdeb9e9

  • SHA512

    f61b16f881d57e88fab827dda15a52835038434a890c318d2994ca2773835221f96982de523a06c5369489199a38207b701db523885ce9ecb5bc5ef712a03c32

  • SSDEEP

    12288:Q0I6gujHEgtd9akjGPMaDXJC2xwY2/ZpvkqrLa:Q0nguH7Z2ZJC2xfkZpvkua

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks for VirtualBox DLLs, possible anti-VM trick
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1732

Network

  • flag-us
    DNS
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    118.duckdns.org
    IN A
    Response
    118.duckdns.org
    IN A
    194.207.146.248
  • flag-us
    DNS
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    118.duckdns.org
    IN A
    Response
    118.duckdns.org
    IN A
    194.207.146.248
  • flag-us
    DNS
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    118.duckdns.org
    IN A
    Response
    118.duckdns.org
    IN A
    194.207.146.248
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 194.207.146.248:9003
    118.duckdns.org
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 8.8.8.8:53
    118.duckdns.org
    dns
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    61 B
    77 B
    1
    1

    DNS Request

    118.duckdns.org

    DNS Response

    194.207.146.248

  • 8.8.8.8:53
    118.duckdns.org
    dns
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    61 B
    77 B
    1
    1

    DNS Request

    118.duckdns.org

    DNS Response

    194.207.146.248

  • 8.8.8.8:53
    118.duckdns.org
    dns
    e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
    61 B
    77 B
    1
    1

    DNS Request

    118.duckdns.org

    DNS Response

    194.207.146.248

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1732-0-0x0000000074231000-0x0000000074232000-memory.dmp

    Filesize

    4KB

  • memory/1732-1-0x0000000074230000-0x00000000747DB000-memory.dmp

    Filesize

    5.7MB

  • memory/1732-2-0x0000000074230000-0x00000000747DB000-memory.dmp

    Filesize

    5.7MB

  • memory/1732-3-0x0000000074230000-0x00000000747DB000-memory.dmp

    Filesize

    5.7MB

  • memory/1732-4-0x0000000074230000-0x00000000747DB000-memory.dmp

    Filesize

    5.7MB

  • memory/1732-5-0x0000000074230000-0x00000000747DB000-memory.dmp

    Filesize

    5.7MB

  • memory/1732-8-0x0000000074230000-0x00000000747DB000-memory.dmp

    Filesize

    5.7MB

  • memory/1732-9-0x0000000074230000-0x00000000747DB000-memory.dmp

    Filesize

    5.7MB

  • memory/1732-11-0x0000000074230000-0x00000000747DB000-memory.dmp

    Filesize

    5.7MB

  • memory/1732-12-0x0000000074230000-0x00000000747DB000-memory.dmp

    Filesize

    5.7MB

  • memory/1732-15-0x0000000074230000-0x00000000747DB000-memory.dmp

    Filesize

    5.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.