Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/09/2024, 14:25

General

  • Target

    e4f61c9f9bcee52224b350c2fba9aceb_JaffaCakes118.exe

  • Size

    516KB

  • MD5

    e4f61c9f9bcee52224b350c2fba9aceb

  • SHA1

    952e986bce8c0d33cae31c0585e52be7fcddb55f

  • SHA256

    d523bde80f1d11c9f7da2fa0da2a091ee47f27ec67f21b3e905666d2ef40e6a8

  • SHA512

    53afc4739dfb95355295de86cdecf768384e8e3cb3ae1af948018803d18d079c0582fef319f30ad8b3b8a24e720c19f59a9fe3b9dfeda932471354148eb40f85

  • SSDEEP

    6144:NnytOc+R1cI1+U0JfLm6r1oG3a6qbKaRi:NnytOp+U05vlb

Malware Config

Extracted

Family

gozi

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4f61c9f9bcee52224b350c2fba9aceb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e4f61c9f9bcee52224b350c2fba9aceb_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Users\Admin\AppData\Local\Temp\170_ssylok_na_poleznye_programmy-spaces_.exe
      "C:\Users\Admin\AppData\Local\Temp\170_ssylok_na_poleznye_programmy-spaces_.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\NO_PWDS_report_16-09-2024_14-25-12-6E7467B0-BDHP.bin

    Filesize

    1KB

    MD5

    2ad0ad6be53d74ff53086fd8b6debf6e

    SHA1

    d39237e4406c345fd25b5ce73687ea1e07333ec9

    SHA256

    f3c75fd229c00b3b8119a242e737fcbfec182ef86744488df244b195daea048d

    SHA512

    98ba28ec3624792ff8b9e2671d9ba474e56172adee2de7b5c34f2103e617c1f1f4e04b6f92a26fb67eb5004efc59fcb2a015387c6df78d0dd4d38b6d7a44a84a

  • \Users\Admin\AppData\Local\Temp\170_ssylok_na_poleznye_programmy-spaces_.exe

    Filesize

    127KB

    MD5

    6c0d485b229c0aaf0786ba947e7da13c

    SHA1

    2d127be9374b47306112fe985b3d7028e5780861

    SHA256

    dcd798576e764e7a88e7e71c3ed90e033efa74944413e968a27e622e3004d771

    SHA512

    73787f4dcceb07373238583ad1c25b551a4726420a79b1407a4c7b420964aa13fda3db92f14e535b964cf06baa40eeb51b29724a0c1b85e409654e0bf0ff8b03

  • memory/1348-0-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/1348-10-0x00000000031D0000-0x000000000352F000-memory.dmp

    Filesize

    3.4MB

  • memory/1348-11-0x00000000031D0000-0x000000000352F000-memory.dmp

    Filesize

    3.4MB

  • memory/1348-21-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/1348-27-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2796-12-0x0000000000400000-0x000000000075F000-memory.dmp

    Filesize

    3.4MB

  • memory/2796-20-0x0000000000400000-0x000000000075F000-memory.dmp

    Filesize

    3.4MB