Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe
-
Size
939KB
-
MD5
ef706e60b202ee7d320f0cd9cbdec1b9
-
SHA1
64a34f5e436ae0df2c476c8239072f4333eaac69
-
SHA256
0867aae175ae9035b4e452386923c8b6e2ceefe8fd37b850f2b5a88e91a71f1d
-
SHA512
2725dbabaa5a4b8da258da17bea6c7bde7950591026cf6058551235214c635fba430d1fac4534da237117064c882f5e635c3c611223c2efa1df52641c2bad101
-
SSDEEP
12288:LtsyVG0Yco+gunQUBCEAWfykqVNeN24epxozOJhaXL3F2Soypj:La+G7ZunQU1aVNeN2joz8hEL3cSJp
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
wtfomg88
Signatures
-
Detected Nirsoft tools 16 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/memory/2704-11-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2824-19-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral1/memory/2864-26-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral1/memory/2864-28-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral1/memory/2872-37-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2824-39-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral1/memory/2872-42-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2600-53-0x0000000000400000-0x000000000043D000-memory.dmp Nirsoft behavioral1/memory/3004-63-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral1/memory/1256-74-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/1912-89-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral1/memory/2520-98-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2140-114-0x0000000000400000-0x000000000043D000-memory.dmp Nirsoft behavioral1/memory/1740-119-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral1/memory/1304-121-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral1/memory/1304-123-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft -
Executes dropped EXE 12 IoCs
pid Process 2704 Dialup.exe 2824 Firefox.exe 2864 Microsoft.exe 2872 InternetExplorer.exe 2600 Chrome.exe 3004 Opera.exe 1256 Dialup.exe 1304 Firefox.exe 1912 Microsoft.exe 2520 InternetExplorer.exe 2140 Chrome.exe 1740 Opera.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x000800000001686c-7.dat upx behavioral1/memory/2704-8-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2704-11-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/files/0x0008000000016c73-17.dat upx behavioral1/memory/2824-19-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/files/0x0007000000016cc5-25.dat upx behavioral1/memory/2864-26-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2864-28-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/files/0x0007000000016d1d-34.dat upx behavioral1/memory/2872-37-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2824-39-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/2872-42-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/files/0x0008000000016d36-48.dat upx behavioral1/memory/2600-49-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral1/memory/2600-53-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral1/files/0x00060000000175e7-58.dat upx behavioral1/memory/3004-60-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/3004-63-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/1256-70-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/1256-74-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/1304-81-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/1912-88-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1912-89-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2520-96-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2520-98-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1740-115-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/2140-114-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral1/memory/1740-119-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/1304-121-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/1304-123-0x0000000000400000-0x0000000000419000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 whatismyip.com -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dialup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dialup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opera.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InternetExplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InternetExplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chrome.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2864 Microsoft.exe Token: SeDebugPrivilege 2872 InternetExplorer.exe Token: SeRestorePrivilege 2872 InternetExplorer.exe Token: SeBackupPrivilege 2872 InternetExplorer.exe Token: SeDebugPrivilege 1912 Microsoft.exe Token: SeDebugPrivilege 2520 InternetExplorer.exe Token: SeRestorePrivilege 2520 InternetExplorer.exe Token: SeBackupPrivilege 2520 InternetExplorer.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2704 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 32 PID 1792 wrote to memory of 2704 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 32 PID 1792 wrote to memory of 2704 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 32 PID 1792 wrote to memory of 2704 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 32 PID 1792 wrote to memory of 2824 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 33 PID 1792 wrote to memory of 2824 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 33 PID 1792 wrote to memory of 2824 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 33 PID 1792 wrote to memory of 2824 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 33 PID 1792 wrote to memory of 2864 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 34 PID 1792 wrote to memory of 2864 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 34 PID 1792 wrote to memory of 2864 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 34 PID 1792 wrote to memory of 2864 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 34 PID 1792 wrote to memory of 2872 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 35 PID 1792 wrote to memory of 2872 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 35 PID 1792 wrote to memory of 2872 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 35 PID 1792 wrote to memory of 2872 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 35 PID 1792 wrote to memory of 2600 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 36 PID 1792 wrote to memory of 2600 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 36 PID 1792 wrote to memory of 2600 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 36 PID 1792 wrote to memory of 2600 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 36 PID 1792 wrote to memory of 3004 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 37 PID 1792 wrote to memory of 3004 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 37 PID 1792 wrote to memory of 3004 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 37 PID 1792 wrote to memory of 3004 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 37 PID 1792 wrote to memory of 1256 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 38 PID 1792 wrote to memory of 1256 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 38 PID 1792 wrote to memory of 1256 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 38 PID 1792 wrote to memory of 1256 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 38 PID 1792 wrote to memory of 1304 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 39 PID 1792 wrote to memory of 1304 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 39 PID 1792 wrote to memory of 1304 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 39 PID 1792 wrote to memory of 1304 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 39 PID 1792 wrote to memory of 1912 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 40 PID 1792 wrote to memory of 1912 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 40 PID 1792 wrote to memory of 1912 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 40 PID 1792 wrote to memory of 1912 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 40 PID 1792 wrote to memory of 2520 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 41 PID 1792 wrote to memory of 2520 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 41 PID 1792 wrote to memory of 2520 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 41 PID 1792 wrote to memory of 2520 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 41 PID 1792 wrote to memory of 2140 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 42 PID 1792 wrote to memory of 2140 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 42 PID 1792 wrote to memory of 2140 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 42 PID 1792 wrote to memory of 2140 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 42 PID 1792 wrote to memory of 1740 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 43 PID 1792 wrote to memory of 1740 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 43 PID 1792 wrote to memory of 1740 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 43 PID 1792 wrote to memory of 1740 1792 ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ef706e60b202ee7d320f0cd9cbdec1b9_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\Dialup.exeC:\Users\Admin\AppData\Local\Temp\Dialup.exe /stext C:\Users\Admin\AppData\Local\Temp\Dialup.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2704
-
-
C:\Users\Admin\AppData\Local\Temp\Firefox.exeC:\Users\Admin\AppData\Local\Temp\Firefox.exe /stext C:\Users\Admin\AppData\Local\Temp\Firefox.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2824
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft.exeC:\Users\Admin\AppData\Local\Temp\Microsoft.exe /stext C:\Users\Admin\AppData\Local\Temp\Microsoft.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
C:\Users\Admin\AppData\Local\Temp\InternetExplorer.exeC:\Users\Admin\AppData\Local\Temp\InternetExplorer.exe /stext C:\Users\Admin\AppData\Local\Temp\InternetExplorer.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
C:\Users\Admin\AppData\Local\Temp\Chrome.exeC:\Users\Admin\AppData\Local\Temp\Chrome.exe /stext C:\Users\Admin\AppData\Local\Temp\Chrome.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\Opera.exeC:\Users\Admin\AppData\Local\Temp\Opera.exe /stext C:\Users\Admin\AppData\Local\Temp\Opera.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3004
-
-
C:\Users\Admin\AppData\Local\Temp\Dialup.exeC:\Users\Admin\AppData\Local\Temp\Dialup.exe /stext C:\Users\Admin\AppData\Local\Temp\Dialup.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1256
-
-
C:\Users\Admin\AppData\Local\Temp\Firefox.exeC:\Users\Admin\AppData\Local\Temp\Firefox.exe /stext C:\Users\Admin\AppData\Local\Temp\Firefox.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1304
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft.exeC:\Users\Admin\AppData\Local\Temp\Microsoft.exe /stext C:\Users\Admin\AppData\Local\Temp\Microsoft.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Users\Admin\AppData\Local\Temp\InternetExplorer.exeC:\Users\Admin\AppData\Local\Temp\InternetExplorer.exe /stext C:\Users\Admin\AppData\Local\Temp\InternetExplorer.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Users\Admin\AppData\Local\Temp\Chrome.exeC:\Users\Admin\AppData\Local\Temp\Chrome.exe /stext C:\Users\Admin\AppData\Local\Temp\Chrome.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2140
-
-
C:\Users\Admin\AppData\Local\Temp\Opera.exeC:\Users\Admin\AppData\Local\Temp\Opera.exe /stext C:\Users\Admin\AppData\Local\Temp\Opera.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
125KB
MD59b3b1c0db965166319469b2afa6c4f0c
SHA19f1e65a3056dff872949329c4e5e70c007cc5621
SHA256dbfa10a7deeb6d1ac8fd95ffeb23b87adc58e6388e522812fabe7f710e3cdd89
SHA512c11512599b83fa1875a67915a7e7454512ed8300a0a47c16692ebc1f526755c39c795fe9721dd97d417bfcb29f9e4c1f3283cf4c426af6571b3996005f7e4f5e
-
Filesize
37KB
MD59c8872c879d0a9d82988920488370864
SHA187ff4231547462e6474c832e28831dd691d83fd4
SHA2568f576d5191721f8fdb47bb22950f43fc8f2c9cc880fe067090ed96e6fcb07a97
SHA5123c413427c46ef92a412840479896841ffd5c6eb9215b8ecc416cdbd4f8e0f2eb643ed3b7f2e18eb5710ba7c55e1cd82af6637285ee364e069503c5ecc187cb2e
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
37KB
MD5a1d6a37917dcf4471486bc5a0e725cc6
SHA15b09f10dc215078ae44f535de12630c38f3b86e3
SHA2568a06acd1158060a54d67098f07c1ff7895f799bc5834179b8aae04d28fb60e17
SHA5125798a5d85052d5c2f6b781b91a400c85bc96c0127cc4e18079bff1f17bd302dc07c0f015ddf1105621a841680057322eb0172ba06063f55d795b7b079f1d26d2
-
Filesize
42KB
MD528c110b8d0ad095131c8d06043678086
SHA1c684cf321e890e0e766a97609a4cde866156d6c5
SHA256dbc2216d5f31f5218e940e3d802998dee90eeb69af69cbeb063c69c6a5a3f1e1
SHA512065e043b76b0e1163e73f4a1c257bae793ae9b46bff1951956c2174ef91deb2528730da77aab76b9e7246d705c3b8c1d23f05dc3b161cacabf3e52d0f563c922
-
Filesize
63KB
MD5fbb93d4c91453b06414d6973152d904e
SHA14624232c5450e7e9e7ba1f2113a07f8800dc5b5f
SHA2568898b138a3f238fa985992a9d0e48f6b5865dd2cc35e08b83fa326260c510ffe
SHA5124ed926d230af576a945bdd4d9b2d4001e8036abbcf1ef9a35669823d9420b6d95b426d80384a6fd022165c1fc2485fda0e28193b99b301927236928ddfcac6f7
-
Filesize
38KB
MD537a89021ab1fbe5668c3974abc794bd4
SHA18ccaa4406f907a5a938fbb2db9d5af27092b811d
SHA2562cb9a3d9587f79a6b1cfa95020b81d7d0d3cf9aa6ebf992f3b5e4ecf19bca8a8
SHA5126eaef2c2c29eb5363a0193489dc989527e4087c61fe926efbbd8a0e3cc8b9675285a94d392ee0a906dfc109566cc144ab07166fd5b3defbfc8afd66d3fe8d1b8