Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

fec5b0c4e6...18.exe

windows7-x64

8

fec5b0c4e6...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/09/2024, 15:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fec5b0c4e672551aa885bca7271087dd_JaffaCakes118.exe

  • Size

    26KB

  • MD5

    fec5b0c4e672551aa885bca7271087dd

  • SHA1

    f9c51f495adf12825f7e3dbf5be1e2ad335fe03d

  • SHA256

    eb9dc72bfe286fc6577de6f8c16af8265aa504b2268e58fe4affa085de59455d

  • SHA512

    e8adb0b722e7d1bb696477130e0409fd56975b819ac5abc5e172db4d3e03b026cfc6c3e93fa9ec22e09560d8c204dedfd58be5e04aec387f18e1787ee0c73335

  • SSDEEP

    768:olRtxfnkWt+bIRQPKeVjQ5lcZ6fdUHDfXUY:uQWwbsQP9Qk4dELXJ

Score
8/10
discoveryevasionexecutionpersistence

Malware Config

Signatures

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fec5b0c4e672551aa885bca7271087dd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fec5b0c4e672551aa885bca7271087dd_JaffaCakes118.exe"
    1⤵
    • Event Triggered Execution: Image File Execution Options Injection
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:552
    • C:\Program Files\AVav.pif
      "C:\Program Files\AVav.pif"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" c:\rvts.dll,RundllTest
        3⤵
        • Sets service image path in registry
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: LoadsDriver
        PID:2132
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net1 start server
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3852
      • C:\Windows\SysWOW64\net1.exe
        net1 start server
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4672
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c sc delete RavCCenter
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4796
      • C:\Windows\SysWOW64\sc.exe
        sc delete RavCCenter
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4076
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c sc delete RsScanSrv
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3324
      • C:\Windows\SysWOW64\sc.exe
        sc delete RsScanSrv
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3640
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c sc delete RavTask
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Windows\SysWOW64\sc.exe
        sc delete RavTask
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2156
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c sc delete RsRavMon
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3816
      • C:\Windows\SysWOW64\sc.exe
        sc delete RsRavMon
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

1
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\AVav.pif
    Filesize

    9KB

    MD5

    286ce5a0fe1159845c2ae460127b0908

    SHA1

    9eefff66604c149c68c9f69fad8f68df2bbaffaf

    SHA256

    a287fbf428821f1d6b007228d4285b4c264e4a7c07e4185e59fe7ddb7a14e67c

    SHA512

    5d6b631726b2f88001fcfb8669d54f8094a8a3adebcd73e7ef9853a1fb58999959243599a9d7d25b7af83a89b145a76fd4ae30c328f766018668a3f362981647

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\dllC6AB.tmp
    Filesize

    12KB

    MD5

    5830d381bf0e4f36a2ec71bd9bb78b9d

    SHA1

    861996b7b9c53650a42c29762890e760e1deb796

    SHA256

    f686125e8c12844e4f61d0cf18dabbea16988a61e35ea6712b222e2334f2e658

    SHA512

    ec91e98bacee67310ed266ec41d3394ccd6706a08bdb1cd519b587a2507279a671bee5c396b4b5f19a115ff3a1baeaddaa60e7a3ab40ab59162eb561136d2dd3

    Download Submit

  • \??\c:\rvts.dll
    Filesize

    7KB

    MD5

    e6e3b91e5461e416b8810234f74f14fd

    SHA1

    ae57654ec74805a0913d253862615baab8891b50

    SHA256

    36de90ec1f48ee666aef44030bf896adc59e5a2be0a9a30cf437a0827a75bfe1

    SHA512

    f71337962f406ce0c63e37f33dfde2501cc3230afaa1e63da17d3f9e409248c6a035af8b524bb04fb606b0a42db263ff936f6f9a361a3610a033fa4efa81db36

    Download Submit

  • memory/552-18-0x0000000010000000-0x000000001000A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/552-19-0x0000000000660000-0x0000000000661000-memory.dmp

    Filesize

    4KB

    Download

  • memory/552-32-0x0000000010000000-0x000000001000A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1696-6-0x0000000013140000-0x0000000013144000-memory.dmp

    Filesize

    16KB

    Download

  • memory/2132-10-0x0000000010000000-0x0000000010008000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2132-11-0x00000000008C0000-0x00000000008C1000-memory.dmp

    Filesize

    4KB

    Download