Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/09/2024, 11:11
Static task
static1
Behavioral task
behavioral1
Sample
e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe
-
Size
385KB
-
MD5
e8fcccc14df4c8fbde4223b16fdb4e63
-
SHA1
6bb4317b855e9f07c9f63b33455eeaa7335bfade
-
SHA256
58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a
-
SHA512
8cb6aab343972ef7384c6e8e4d2418e168c35e448a4e1183d650776762c407239d265838fe1c03bd10cf4415238c4e7b08ed9a9d95a62f70bcc4f50561b01c1c
-
SSDEEP
3072:ZpXsDgp6KE5SNnxqFUKpMgcTPaAp3DLW11eJzf:ZpEmxqFUKigcTSApnW1i
Malware Config
Extracted
remcos
RemoteHost
79.172.242.28:2404
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-6PPTSU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2320 svhost.exe -
Loads dropped DLL 1 IoCs
pid Process 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2720 set thread context of 2320 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 33 -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\8778\name.exe:Zone.Identifier cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\8778\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe Token: 33 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2720 wrote to memory of 2844 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 30 PID 2720 wrote to memory of 2844 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 30 PID 2720 wrote to memory of 2844 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 30 PID 2720 wrote to memory of 2844 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 30 PID 2844 wrote to memory of 2840 2844 cmd.exe 32 PID 2844 wrote to memory of 2840 2844 cmd.exe 32 PID 2844 wrote to memory of 2840 2844 cmd.exe 32 PID 2844 wrote to memory of 2840 2844 cmd.exe 32 PID 2720 wrote to memory of 2320 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 33 PID 2720 wrote to memory of 2320 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 33 PID 2720 wrote to memory of 2320 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 33 PID 2720 wrote to memory of 2320 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 33 PID 2720 wrote to memory of 2320 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 33 PID 2720 wrote to memory of 2320 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 33 PID 2720 wrote to memory of 2320 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 33 PID 2720 wrote to memory of 2320 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 33 PID 2720 wrote to memory of 2320 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 33 PID 2720 wrote to memory of 2320 2720 e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e8fcccc14df4c8fbde4223b16fdb4e63_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\8778\name.exe.lnk" /f3⤵
- System Location Discovery: System Language Discovery
PID:2840
-
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD5e8fcccc14df4c8fbde4223b16fdb4e63
SHA16bb4317b855e9f07c9f63b33455eeaa7335bfade
SHA25658cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a
SHA5128cb6aab343972ef7384c6e8e4d2418e168c35e448a4e1183d650776762c407239d265838fe1c03bd10cf4415238c4e7b08ed9a9d95a62f70bcc4f50561b01c1c
-
Filesize
1.6MB
MD532827e69b293b99013bbbe37d029245d
SHA1bc9f80a38f09354d71467a05b0c5a82c3f7dac53
SHA2569250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f
SHA51258c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5