Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 10:30
Static task
static1
Behavioral task
behavioral1
Sample
0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe
-
Size
120KB
-
MD5
0a3769db6a54f333863175a07dd9087f
-
SHA1
f7ec8045756e4ba3af748fef35590aa41766454c
-
SHA256
cac8fe9363cd9e2a31aeb383fe2df3800a4ca35edbe9c697093a13f1067f0292
-
SHA512
9315eb828d82ddecf54e2675ee495d481dcfe88e515dd41ccd8da1a0914b7cfad529027503700b05787fdb230fd5e646e82f3d43342723bd08cb5241de3ec572
-
SSDEEP
1536:m5Tzro/5XkgEUs6MB0nUQP9TswNnZ7UgIoDlklyEYwuoVMG5W7QZg7II/CwDPTxU:AO5Xk7Us6NnVACZpNklyBG5iWItD92v
Malware Config
Extracted
netwire
ghjghjjhgjhgjhjhgjh.zapto.org:20000
-
activex_autorun
true
-
activex_key
{5D03ES3I-Y34Q-83S6-0YJQ-4M3410JYQ88K}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Extracted
latentbot
ghjghjjhgjhgjhjhgjh.zapto.org
Signatures
-
NetWire RAT payload 3 IoCs
resource yara_rule behavioral1/memory/2972-16-0x0000000000400000-0x0000000000417000-memory.dmp netwire behavioral1/memory/2748-27-0x0000000000400000-0x0000000000417000-memory.dmp netwire behavioral1/memory/2748-28-0x0000000000400000-0x0000000000417000-memory.dmp netwire -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D03ES3I-Y34Q-83S6-0YJQ-4M3410JYQ88K} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D03ES3I-Y34Q-83S6-0YJQ-4M3410JYQ88K}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Executes dropped EXE 2 IoCs
pid Process 1712 Host.exe 2748 Host.exe -
Loads dropped DLL 2 IoCs
pid Process 2972 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 2972 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 596 set thread context of 2972 596 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 31 PID 1712 set thread context of 2748 1712 Host.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 596 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 1712 Host.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 596 wrote to memory of 2972 596 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 31 PID 596 wrote to memory of 2972 596 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 31 PID 596 wrote to memory of 2972 596 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 31 PID 596 wrote to memory of 2972 596 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 31 PID 596 wrote to memory of 2972 596 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 31 PID 596 wrote to memory of 2972 596 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 31 PID 596 wrote to memory of 2972 596 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 31 PID 596 wrote to memory of 2972 596 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 31 PID 596 wrote to memory of 2972 596 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 31 PID 596 wrote to memory of 2972 596 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 31 PID 2972 wrote to memory of 1712 2972 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 32 PID 2972 wrote to memory of 1712 2972 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 32 PID 2972 wrote to memory of 1712 2972 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 32 PID 2972 wrote to memory of 1712 2972 0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe 32 PID 1712 wrote to memory of 2748 1712 Host.exe 33 PID 1712 wrote to memory of 2748 1712 Host.exe 33 PID 1712 wrote to memory of 2748 1712 Host.exe 33 PID 1712 wrote to memory of 2748 1712 Host.exe 33 PID 1712 wrote to memory of 2748 1712 Host.exe 33 PID 1712 wrote to memory of 2748 1712 Host.exe 33 PID 1712 wrote to memory of 2748 1712 Host.exe 33 PID 1712 wrote to memory of 2748 1712 Host.exe 33 PID 1712 wrote to memory of 2748 1712 Host.exe 33 PID 1712 wrote to memory of 2748 1712 Host.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0a3769db6a54f333863175a07dd9087f_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
PID:2748
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD50a3769db6a54f333863175a07dd9087f
SHA1f7ec8045756e4ba3af748fef35590aa41766454c
SHA256cac8fe9363cd9e2a31aeb383fe2df3800a4ca35edbe9c697093a13f1067f0292
SHA5129315eb828d82ddecf54e2675ee495d481dcfe88e515dd41ccd8da1a0914b7cfad529027503700b05787fdb230fd5e646e82f3d43342723bd08cb5241de3ec572